@logto/cli 1.0.0-rc.1 → 1.0.0-rc.3

package/LICENSE

@@ -1,3 +1,9 @@
+Portions of this software are licensed as follows:
+
+* All content that resides under the "packages/cloud" directory of this repository, if that directory exists, is licensed under the license defined in "packages/cloud/LICENSE" (Elastic-2.0).
+* All third party components incorporated into this software are licensed under the original license provided by the owner of the applicable component.
+* Content outside of the above mentioned directories or restrictions above is available under the "MPL-2.0" license as defined below.
+
 Mozilla Public License Version 2.0
 ==================================
 

package/lib/commands/connector/add.d.ts

@@ -5,5 +5,6 @@ declare const add: CommandModule<{
     packages?: string[];
     path?: string;
     official: boolean;
+    cloud: boolean;
 }>;
 export default add;

package/lib/commands/connector/add.js

@@ -1,4 +1,4 @@
-import { log } from '../../utilities.js';
+import { log } from '../../utils.js';
 import { addConnectors, addOfficialConnectors, inquireInstancePath } from './utils.js';
 const add = {
     command: ['add [packages...]', 'a', 'install', 'i'],
@@ -16,11 +16,21 @@ const add = {
         default: false,
         describe: 'Add all official connectors.\n' +
             "If it's true, the specified package names will be ignored.",
+    })
+        .option('cloud', {
+        describe: 'Add additional connectors for Logto Cloud',
+        type: 'boolean',
+        default: false,
+        hidden: true,
     }),
-    handler: async ({ packages: packageNames, path, official }) => {
+    handler: async ({ packages: packageNames, path, official, cloud }) => {
         const instancePath = await inquireInstancePath(path);
+        if (cloud && !official) {
+            log.error('--cloud option can only be used with --official option');
+        }
         if (official) {
-            await addOfficialConnectors(instancePath);
+            // Add demo connectors for Logto Cloud only
+            await addOfficialConnectors(instancePath, cloud);
         }
         else {
             if (!packageNames?.length) {

package/lib/commands/connector/remove.js

@@ -1,6 +1,6 @@
 import fs from 'fs/promises';
 import chalk from 'chalk';
-import { log } from '../../utilities.js';
+import { log } from '../../utils.js';
 import { getConnectorPackagesFrom } from './utils.js';
 const remove = {
     command: ['remove [packages...]', 'rm', 'delete'],

package/lib/commands/connector/utils.d.ts

@@ -15,6 +15,6 @@ export declare const npmPackResultGuard: z.ZodArray<z.ZodObject<{
 export declare const inquireInstancePath: (initialPath?: string) => Promise<string>;
 export declare const normalizePackageName: (name: string) => string;
 export declare const isOfficialConnector: (packageName: string) => boolean;
-export declare const getConnectorPackagesFrom: (instancePath?: string) => Promise<import("../../utilities.js").ConnectorPackage[]>;
+export declare const getConnectorPackagesFrom: (instancePath?: string) => Promise<import("../../utils.js").ConnectorPackage[]>;
 export declare const addConnectors: (instancePath: string, packageNames: string[]) => Promise<void>;
-export declare const addOfficialConnectors: (instancePath: string) => Promise<void>;
+export declare const addOfficialConnectors: (instancePath: string, includingCloudConnectors?: boolean) => Promise<void>;

package/lib/commands/connector/utils.js

@@ -12,7 +12,7 @@ import pRetry from 'p-retry';
 import tar from 'tar';
 import { z } from 'zod';
 import { connectorDirectory } from '../../constants.js';
-import { getConnectorPackagesFromDirectory, isTty, log, oraPromise } from '../../utilities.js';
+import { getConnectorPackagesFromDirectory, isTty, log, oraPromise } from '../../utils.js';
 import { defaultPath } from '../install/utils.js';
 const coreDirectory = 'packages/core';
 const execPromise = promisify(exec);
@@ -127,7 +127,7 @@ export const addConnectors = async (instancePath, packageNames) => {
     }
 };
 const officialConnectorPrefix = '@logto/connector-';
-const fetchOfficialConnectorList = async () => {
+const fetchOfficialConnectorList = async (includingCloudConnectors = false) => {
     const fetchList = async (from = 0, size = 20) => {
         const parameters = new URLSearchParams({
             text: officialConnectorPrefix,
@@ -142,10 +142,11 @@ const fetchOfficialConnectorList = async () => {
     for (let page = 0;; ++page) {
         // eslint-disable-next-line no-await-in-loop
         const { objects } = await fetchList(page * 20, 20);
+        const excludeList = ['mock', 'kit', ...(includingCloudConnectors ? [] : ['logto'])];
         // eslint-disable-next-line @silverhand/fp/no-mutating-methods
         packages.push(...objects
             .filter(({ package: { name, scope } }) => scope === 'logto' &&
-            ['mock', 'kit'].every((excluded) => !name.slice(officialConnectorPrefix.length).startsWith(excluded)))
+            excludeList.every((excluded) => !name.slice(officialConnectorPrefix.length).startsWith(excluded)))
             .map(({ package: data }) => data));
         if (objects.length < 20) {
             break;
@@ -153,8 +154,8 @@ const fetchOfficialConnectorList = async () => {
     }
     return packages;
 };
-export const addOfficialConnectors = async (instancePath) => {
-    const packages = await oraPromise(fetchOfficialConnectorList(), {
+export const addOfficialConnectors = async (instancePath, includingCloudConnectors = false) => {
+    const packages = await oraPromise(fetchOfficialConnectorList(includingCloudConnectors), {
         text: 'Fetch official connector list',
         prefixText: chalk.blue('[info]'),
     });

package/lib/commands/database/alteration/index.js

@@ -2,7 +2,7 @@ import { conditionalString } from '@silverhand/essentials';
 import chalk from 'chalk';
 import { createPoolFromConfig } from '../../../database.js';
 import { getCurrentDatabaseAlterationTimestamp, updateDatabaseTimestamp, } from '../../../queries/system.js';
-import { log } from '../../../utilities.js';
+import { log } from '../../../utils.js';
 import { getAlterationFiles, getTimestampFromFilename } from './utils.js';
 import { chooseAlterationsByVersion, chooseRevertAlterationsByVersion } from './version.js';
 const importAlterationScript = async (filePath) => {

package/lib/commands/database/alteration/index.test.js

@@ -25,7 +25,7 @@ describe('getAvailableAlterations()', () => {
         await expect(getAvailableAlterations(pool)).resolves.toEqual(files);
     });
     it('returns files whose timestamp is greater then database timestamp', async () => {
-        getCurrentDatabaseAlterationTimestamp.mockResolvedValue(1663923770);
+        getCurrentDatabaseAlterationTimestamp.mockResolvedValue(1_663_923_770);
         await expect(getAvailableAlterations(pool)).resolves.toEqual([files[1], files[2]]);
     });
 });

package/lib/commands/database/alteration/utils.js

@@ -3,7 +3,7 @@ import fs from 'fs/promises';
 import { fileURLToPath } from 'node:url';
 import path from 'path';
 import { findPackage } from '@logto/shared';
-import { getPathInModule } from '../../../utilities.js';
+import { getPathInModule } from '../../../utils.js';
 const currentDirname = path.dirname(fileURLToPath(import.meta.url));
 const alterationFilenameRegex = /-([\d.]+)-?.*\.js$/;
 export const getTimestampFromFilename = (filename) => {

package/lib/commands/database/alteration/version.js

@@ -2,7 +2,7 @@ import { assert, conditional } from '@silverhand/essentials';
 import chalk from 'chalk';
 import inquirer from 'inquirer';
 import { SemVer, compare, eq, gt } from 'semver';
-import { findLastIndex, isTty, log } from '../../../utilities.js';
+import { findLastIndex, isTty, log } from '../../../utils.js';
 const getVersionStringFromFilename = (filename) => filename.split('-')[0]?.replaceAll('_', '-') ?? 'unknown';
 const getVersionFromFilename = (filename) => {
     try {

package/lib/commands/database/config.js

@@ -1,10 +1,10 @@
-import { LogtoOidcConfigKey, logtoConfigGuards, logtoConfigKeys } from '@logto/schemas';
+import { defaultTenantId, LogtoOidcConfigKey, logtoConfigGuards, logtoConfigKeys, } from '@logto/schemas';
 import { deduplicate, noop } from '@silverhand/essentials';
 import chalk from 'chalk';
 import { createPoolFromConfig } from '../../database.js';
 import { getRowsByKeys, updateValueByKey } from '../../queries/logto-config.js';
-import { log } from '../../utilities.js';
-import { generateOidcCookieKey, generateOidcPrivateKey } from './utilities.js';
+import { log } from '../../utils.js';
+import { generateOidcCookieKey, generateOidcPrivateKey } from './utils.js';
 const validKeysDisplay = chalk.green(logtoConfigKeys.join(', '));
 const validateKeys = (keys) => {
     const invalidKey = (Array.isArray(keys) ? keys : [keys]).find(
@@ -40,12 +40,17 @@ const getConfig = {
         type: 'string',
         array: true,
         default: [],
+    })
+        .option('tenantId', {
+        describe: 'The tenant to operate',
+        type: 'string',
+        default: defaultTenantId,
     }),
-    handler: async ({ key, keys }) => {
+    handler: async ({ key, keys, tenantId }) => {
         const queryKeys = deduplicate([key, ...keys]);
         validateKeys(queryKeys);
         const pool = await createPoolFromConfig();
-        const { rows } = await getRowsByKeys(pool, queryKeys);
+        const { rows } = await getRowsByKeys(pool, tenantId, queryKeys);
         await pool.end();
         console.log(queryKeys
             .map((currentKey) => {
@@ -70,12 +75,17 @@ const setConfig = {
         describe: 'The value to set, should be a valid JSON string',
         type: 'string',
         demandOption: true,
+    })
+        .option('tenantId', {
+        describe: 'The tenant to operate',
+        type: 'string',
+        default: defaultTenantId,
     }),
-    handler: async ({ key, value }) => {
+    handler: async ({ key, value, tenantId }) => {
         validateKeys(key);
         const guarded = logtoConfigGuards[key].parse(JSON.parse(value));
         const pool = await createPoolFromConfig();
-        await updateValueByKey(pool, key, guarded);
+        await updateValueByKey(pool, tenantId, key, guarded);
         await pool.end();
         log.info(`Update ${chalk.green(key)} succeeded`);
     },
@@ -83,15 +93,21 @@ const setConfig = {
 const rotateConfig = {
     command: 'rotate <key>',
     describe: 'Generate a new private or secret key for the given config key and prepend to the key array',
-    builder: (yargs) => yargs.positional('key', {
+    builder: (yargs) => yargs
+        .positional('key', {
         describe: `The key to rotate, one of ${chalk.green(validRotateKeys.join(', '))}`,
         type: 'string',
         demandOption: true,
+    })
+        .option('tenantId', {
+        describe: 'The tenant to operate',
+        type: 'string',
+        default: defaultTenantId,
     }),
-    handler: async ({ key }) => {
+    handler: async ({ key, tenantId }) => {
         validateRotateKey(key);
         const pool = await createPoolFromConfig();
-        const { rows } = await getRowsByKeys(pool, [key]);
+        const { rows } = await getRowsByKeys(pool, tenantId, [key]);
         if (!rows[0]) {
             log.warn('No key found, create a new one');
         }
@@ -99,16 +115,17 @@ const rotateConfig = {
             const parsed = logtoConfigGuards[key].safeParse(rows[0]?.value);
             const original = parsed.success ? parsed.data : [];
             // No need for default. It's already exhaustive
-            // eslint-disable-next-line default-case
             switch (key) {
-                case LogtoOidcConfigKey.PrivateKeys:
+                case LogtoOidcConfigKey.PrivateKeys: {
                     return [await generateOidcPrivateKey(), ...original];
-                case LogtoOidcConfigKey.CookieKeys:
+                }
+                case LogtoOidcConfigKey.CookieKeys: {
                     return [generateOidcCookieKey(), ...original];
+                }
             }
         };
         const rotated = await getValue();
-        await updateValueByKey(pool, key, rotated);
+        await updateValueByKey(pool, tenantId, key, rotated);
         await pool.end();
         log.info(`Rotate ${chalk.green(key)} succeeded, now it has ${rotated.length} keys`);
     },
@@ -127,14 +144,19 @@ const trimConfig = {
         type: 'number',
         default: 1,
         demandOption: true,
+    })
+        .option('tenantId', {
+        describe: 'The tenant to operate',
+        type: 'string',
+        default: defaultTenantId,
     }),
-    handler: async ({ key, length }) => {
+    handler: async ({ key, length, tenantId }) => {
         validateRotateKey(key);
         if (length < 1) {
             log.error('Invalid length provided');
         }
         const pool = await createPoolFromConfig();
-        const { rows } = await getRowsByKeys(pool, [key]);
+        const { rows } = await getRowsByKeys(pool, tenantId, [key]);
         if (!rows[0]) {
             log.warn('No key found, create a new one');
         }
@@ -147,7 +169,7 @@ const trimConfig = {
             return value.slice(0, -length);
         };
         const trimmed = await getValue();
-        await updateValueByKey(pool, key, trimmed);
+        await updateValueByKey(pool, tenantId, key, trimmed);
         await pool.end();
         log.info(`Trim ${chalk.green(key)} succeeded, now it has ${trimmed.length} keys`);
     },

package/lib/commands/database/index.js

@@ -2,10 +2,11 @@ import { noop } from '@silverhand/essentials';
 import alteration from './alteration/index.js';
 import config from './config.js';
 import seed from './seed/index.js';
+import system from './system.js';
 const database = {
     command: ['database', 'db'],
     describe: 'Commands for Logto database',
-    builder: (yargs) => yargs.command(config).command(seed).command(alteration).demandCommand(1),
+    builder: (yargs) => yargs.command(config).command(seed).command(alteration).command(system).demandCommand(1),
     handler: noop,
 };
 export default database;

package/lib/commands/database/seed/cloud.d.ts

@@ -0,0 +1,10 @@
+import type { CommonQueryMethods } from 'slonik';
+/**
+ * Append Redirect URIs for the default tenant callback in cloud Admin Console.
+ * It reads the same env variables as core to construct the cloud `UrlSet`.
+ *
+ * E.g., by default, it will appends `http://localhost:3003/default/callback` to the Redirect URIs.
+ *
+ * For why it is necessary, see the redirect lifecycle of cloud Admin Console.
+ */
+export declare const appendAdminConsoleRedirectUris: (pool: CommonQueryMethods) => Promise<void>;

package/lib/commands/database/seed/cloud.js

@@ -0,0 +1,34 @@
+import { adminConsoleApplicationId, adminTenantId, defaultTenantId } from '@logto/schemas';
+import { GlobalValues } from '@logto/shared';
+import { appendPath } from '@silverhand/essentials';
+import { sql } from 'slonik';
+import { log } from '../../../utils.js';
+/**
+ * Append Redirect URIs for the default tenant callback in cloud Admin Console.
+ * It reads the same env variables as core to construct the cloud `UrlSet`.
+ *
+ * E.g., by default, it will appends `http://localhost:3003/default/callback` to the Redirect URIs.
+ *
+ * For why it is necessary, see the redirect lifecycle of cloud Admin Console.
+ */
+export const appendAdminConsoleRedirectUris = async (pool) => {
+    const redirectUris = new GlobalValues().cloudUrlSet
+        .deduplicated()
+        .flatMap((endpoint) => [defaultTenantId, adminTenantId].map((tenantId) => appendPath(endpoint, tenantId, 'callback')));
+    const metadataKey = sql.identifier(['oidc_client_metadata']);
+    // Copied from packages/cloud/src/queries/tenants.ts
+    // Can be merged into the original once we remove slonik
+    await pool.query(sql `
+    update applications
+    set ${metadataKey} = jsonb_set(
+      ${metadataKey},
+      '{redirectUris}',
+      (select jsonb_agg(distinct value) from jsonb_array_elements(
+        ${metadataKey}->'redirectUris' || ${sql.jsonb(redirectUris.map(String))}
+      ))
+    )
+    where id = ${adminConsoleApplicationId}
+    and tenant_id = ${adminTenantId}
+  `);
+    log.succeed('Appended initial Redirect URIs to Admin Console:', redirectUris.map(String));
+};

package/lib/commands/database/seed/index.d.ts

@@ -1,10 +1,8 @@
 import type { DatabasePool } from 'slonik';
 import type { CommandModule } from 'yargs';
-declare const seedChoices: readonly ["all", "oidc"];
-type SeedChoice = typeof seedChoices[number];
-export declare const seedByPool: (pool: DatabasePool, type: SeedChoice) => Promise<void>;
+export declare const seedByPool: (pool: DatabasePool, cloud?: boolean) => Promise<void>;
 declare const seed: CommandModule<Record<string, unknown>, {
-    type: string;
     swe?: boolean;
+    cloud?: boolean;
 }>;
 export default seed;

package/lib/commands/database/seed/index.js

@@ -1,127 +1,26 @@
-import { readdir, readFile } from 'fs/promises';
-import path from 'path';
-import { generateStandardId } from '@logto/core-kit';
-import { logtoConfigGuards, LogtoOidcConfigKey, managementResource, defaultSignInExperience, createDefaultAdminConsoleConfig, createDemoAppApplication, defaultRole, managementResourceScope, defaultRoleScopeRelation, defaultTenant, } from '@logto/schemas';
-import { Hooks, Tenants } from '@logto/schemas/models';
 import chalk from 'chalk';
-import { sql } from 'slonik';
-import { raw } from 'slonik-sql-tag-raw';
-import { z } from 'zod';
-import { createPoolAndDatabaseIfNeeded, insertInto } from '../../../database.js';
-import { getRowsByKeys, doesConfigsTableExist, updateValueByKey, } from '../../../queries/logto-config.js';
-import { updateDatabaseTimestamp } from '../../../queries/system.js';
-import { getPathInModule, log, oraPromise } from '../../../utilities.js';
+import { createPoolAndDatabaseIfNeeded } from '../../../database.js';
+import { doesConfigsTableExist } from '../../../queries/logto-config.js';
+import { log, oraPromise } from '../../../utils.js';
 import { getLatestAlterationTimestamp } from '../alteration/index.js';
 import { getAlterationDirectory } from '../alteration/utils.js';
-import { oidcConfigReaders } from './oidc-config.js';
-const getExplicitOrder = (query) => {
-    const matched = /\/\*\s*init_order\s*=\s*([\d.]+)\s*\*\//.exec(query)?.[1];
-    return matched ? Number(matched) : undefined;
-};
-const compareQuery = ([t1, q1], [t2, q2]) => {
-    const o1 = getExplicitOrder(q1);
-    const o2 = getExplicitOrder(q2);
-    if (o1 === undefined && o2 === undefined) {
-        return t1.localeCompare(t2);
-    }
-    if (o1 === undefined) {
-        return 1;
-    }
-    if (o2 === undefined) {
-        return -1;
-    }
-    return o1 - o2;
-};
-const createTables = async (connection) => {
-    const tableDirectory = getPathInModule('@logto/schemas', 'tables');
-    const directoryFiles = await readdir(tableDirectory);
-    const tableFiles = directoryFiles.filter((file) => file.endsWith('.sql'));
-    const queries = await Promise.all(tableFiles.map(async (file) => [
-        file,
-        await readFile(path.join(tableDirectory, file), 'utf8'),
-    ]));
-    const allQueries = [
-        [Hooks.tableName, Hooks.raw],
-        [Tenants.tableName, Tenants.raw],
-        ...queries,
-    ];
-    const sorted = allQueries.slice().sort(compareQuery);
-    for (const [, query] of sorted) {
-        // eslint-disable-next-line no-await-in-loop
-        await connection.query(sql `${raw(query)}`);
-    }
-};
-const seedTables = async (connection, latestTimestamp) => {
-    await connection.query(insertInto(defaultTenant, 'tenants'));
-    await Promise.all([
-        connection.query(insertInto(managementResource, 'resources')),
-        connection.query(insertInto(managementResourceScope, 'scopes')),
-        connection.query(insertInto(createDefaultAdminConsoleConfig(), 'logto_configs')),
-        connection.query(insertInto(defaultSignInExperience, 'sign_in_experiences')),
-        connection.query(insertInto(createDemoAppApplication(generateStandardId()), 'applications')),
-        connection.query(insertInto(defaultRole, 'roles')),
-        connection.query(insertInto(defaultRoleScopeRelation, 'roles_scopes')),
-        updateDatabaseTimestamp(connection, latestTimestamp),
-    ]);
-};
-const seedOidcConfigs = async (pool) => {
-    const configGuard = z.object({
-        key: z.nativeEnum(LogtoOidcConfigKey),
-        value: z.unknown(),
-    });
-    const { rows } = await getRowsByKeys(pool, Object.values(LogtoOidcConfigKey));
-    // Filter out valid keys that hold a valid value
-    const result = await Promise.all(rows.map(async (row) => {
-        try {
-            const { key, value } = await configGuard.parseAsync(row);
-            await logtoConfigGuards[key].parseAsync(value);
-            return key;
-        }
-        catch { }
-    }));
-    const existingKeys = new Set(result.filter(Boolean));
-    const validOptions = Object.values(LogtoOidcConfigKey).filter((key) => {
-        const included = existingKeys.has(key);
-        if (included) {
-            log.info(`Key ${chalk.green(key)} exists, skipping`);
-        }
-        return !included;
-    });
-    // The awaits in loop is intended since we'd like to log info in sequence
-    /* eslint-disable no-await-in-loop */
-    for (const key of validOptions) {
-        const { value, fromEnv } = await oidcConfigReaders[key]();
-        if (fromEnv) {
-            log.info(`Read config ${chalk.green(key)} from env`);
-        }
-        else {
-            log.info(`Generated config ${chalk.green(key)}`);
-        }
-        await updateValueByKey(pool, key, value);
-    }
-    /* eslint-enable no-await-in-loop */
-    log.succeed('Seed OIDC config');
-};
-const seedChoices = Object.freeze(['all', 'oidc']);
-export const seedByPool = async (pool, type) => {
+import { createTables, seedCloud, seedTables } from './tables.js';
+export const seedByPool = async (pool, cloud = false) => {
     await pool.transaction(async (connection) => {
-        if (type !== 'oidc') {
-            // Check alteration scripts available in order to insert correct timestamp
-            const latestTimestamp = await getLatestAlterationTimestamp();
-            if (latestTimestamp < 1) {
-                throw new Error(`No alteration script found when seeding the database.\n` +
-                    `Please check \`${getAlterationDirectory()}\` to see if there are alteration scripts available.\n`);
-            }
-            await oraPromise(createTables(connection), {
-                text: 'Create tables',
-                prefixText: chalk.blue('[info]'),
-            });
-            await oraPromise(seedTables(connection, latestTimestamp), {
-                text: 'Seed data',
-                prefixText: chalk.blue('[info]'),
-            });
+        // Check alteration scripts available in order to insert correct timestamp
+        const latestTimestamp = await getLatestAlterationTimestamp();
+        if (latestTimestamp < 1) {
+            throw new Error(`No alteration script found when seeding the database.\n` +
+                `Please check \`${getAlterationDirectory()}\` to see if there are alteration scripts available.\n`);
+        }
+        await oraPromise(createTables(connection), {
+            text: 'Create tables',
+            prefixText: chalk.blue('[info]'),
+        });
+        await seedTables(connection, latestTimestamp);
+        if (cloud) {
+            await seedCloud(connection);
         }
-        await seedOidcConfigs(connection);
     });
 };
 const seed = {
@@ -133,13 +32,12 @@ const seed = {
         alias: 'skip-when-exists',
         type: 'boolean',
     })
-        .positional('type', {
-        describe: 'Optional seed type',
-        type: 'string',
-        choices: seedChoices,
-        default: 'all',
+        .option('cloud', {
+        describe: 'Seed additional cloud data',
+        type: 'boolean',
+        hidden: true,
     }),
-    handler: async ({ type, swe }) => {
+    handler: async ({ swe, cloud }) => {
         const pool = await createPoolAndDatabaseIfNeeded();
         if (swe && (await doesConfigsTableExist(pool))) {
             log.info('Seeding skipped');
@@ -147,10 +45,7 @@ const seed = {
             return;
         }
         try {
-            // Cannot avoid `as` since the official type definition of `yargs` doesn't work.
-            // The value of `type` can be ensured, so it's safe to use `as` here.
-            // eslint-disable-next-line no-restricted-syntax
-            await seedByPool(pool, type);
+            await seedByPool(pool, cloud);
         }
         catch (error) {
             console.error(error);

package/lib/commands/database/seed/oidc-config.d.ts

@@ -1,5 +1,7 @@
 import type { LogtoOidcConfigType } from '@logto/schemas';
 import { LogtoOidcConfigKey } from '@logto/schemas';
+import type { DatabaseTransactionConnection } from 'slonik';
+export declare const seedOidcConfigs: (pool: DatabaseTransactionConnection, tenantId: string) => Promise<void>;
 /**
  * Each config reader will do the following things in order:
  * 1. Try to read value from env (mimic the behavior from the original core)

package/lib/commands/database/seed/oidc-config.js

@@ -1,8 +1,51 @@
 import { readFile } from 'fs/promises';
-import { LogtoOidcConfigKey } from '@logto/schemas';
+import { LogtoOidcConfigKey, logtoConfigGuards } from '@logto/schemas';
 import { getEnvAsStringArray } from '@silverhand/essentials';
-import { generateOidcCookieKey, generateOidcPrivateKey } from '../utilities.js';
+import chalk from 'chalk';
+import { z } from 'zod';
+import { getRowsByKeys, updateValueByKey } from '../../../queries/logto-config.js';
+import { log } from '../../../utils.js';
+import { generateOidcCookieKey, generateOidcPrivateKey } from '../utils.js';
 const isBase64FormatPrivateKey = (key) => !key.includes('-');
+export const seedOidcConfigs = async (pool, tenantId) => {
+    const tenantPrefix = `[${tenantId}]`;
+    const configGuard = z.object({
+        key: z.nativeEnum(LogtoOidcConfigKey),
+        value: z.unknown(),
+    });
+    const { rows } = await getRowsByKeys(pool, tenantId, Object.values(LogtoOidcConfigKey));
+    // Filter out valid keys that hold a valid value
+    const result = await Promise.all(rows.map(async (row) => {
+        try {
+            const { key, value } = await configGuard.parseAsync(row);
+            await logtoConfigGuards[key].parseAsync(value);
+            return key;
+        }
+        catch { }
+    }));
+    const existingKeys = new Set(result.filter(Boolean));
+    const validOptions = Object.values(LogtoOidcConfigKey).filter((key) => {
+        const included = existingKeys.has(key);
+        if (included) {
+            log.info(tenantPrefix, `Key ${chalk.green(key)} exists, skipping`);
+        }
+        return !included;
+    });
+    // The awaits in loop is intended since we'd like to log info in sequence
+    /* eslint-disable no-await-in-loop */
+    for (const key of validOptions) {
+        const { value, fromEnv } = await oidcConfigReaders[key]();
+        if (fromEnv) {
+            log.info(tenantPrefix, `Read config ${chalk.green(key)} from env`);
+        }
+        else {
+            log.info(tenantPrefix, `Generated config ${chalk.green(key)}`);
+        }
+        await updateValueByKey(pool, tenantId, key, value);
+    }
+    /* eslint-enable no-await-in-loop */
+    log.succeed(tenantPrefix, 'Seed OIDC config');
+};
 /**
  * Each config reader will do the following things in order:
  * 1. Try to read value from env (mimic the behavior from the original core)

package/lib/commands/database/seed/tables.d.ts

@@ -0,0 +1,4 @@
+import type { DatabaseTransactionConnection } from 'slonik';
+export declare const createTables: (connection: DatabaseTransactionConnection) => Promise<void>;
+export declare const seedTables: (connection: DatabaseTransactionConnection, latestTimestamp: number) => Promise<void>;
+export declare const seedCloud: (connection: DatabaseTransactionConnection) => Promise<void>;