@wasp.sh/wasp-cli-darwin-x64-unknown 0.25.0 → 0.26.0

package/data/Generator/templates/server/src/auth/providers/config/email.ts

@@ -9,7 +9,7 @@ import { getSignupRoute } from "../email/signup.js";
 import { getRequestPasswordResetRoute } from "../email/requestPasswordReset.js";
 import { resetPassword } from "../email/resetPassword.js";
 import { verifyEmail } from "../email/verifyEmail.js";
-import { GetVerificationEmailContentFn, GetPasswordResetEmailContentFn } from "wasp/server/auth/email";
+import { GetVerificationEmailContentFn, GetPasswordResetEmailContentFn } from "wasp/server/auth";
 import { defineHandler } from "wasp/server/utils";
 import { env } from "wasp/server";
 
@@ -52,8 +52,8 @@ const _waspGetPasswordResetEmailContent: GetPasswordResetEmailContentFn = ({ pas
 {=/ getPasswordResetEmailContent.isDefined =}
 
 const fromField: EmailFromField = {
-    name: '{= fromField.name =}',
-    email: '{= fromField.email =}',
+    name: {=& fromField.name =},
+    email: {=& fromField.email =},
 };
 
 const config: ProviderConfig = {
@@ -68,7 +68,7 @@ const config: ProviderConfig = {
         const signupRoute = defineHandler(getSignupRoute({
             userSignupFields: _waspUserSignupFields,
             fromField,
-            clientRoute: '{= emailVerificationClientRoute =}',
+            clientRoute: {=& emailVerificationClientRoute =},
             getVerificationEmailContent: _waspGetVerificationEmailContent,
             {=# isDevelopment =}
             isEmailAutoVerified: env.SKIP_EMAIL_VERIFICATION_IN_DEV,
@@ -81,7 +81,7 @@ const config: ProviderConfig = {
 
         const requestPasswordResetRoute = defineHandler(getRequestPasswordResetRoute({
             fromField,
-            clientRoute: '{= passwordResetClientRoute =}',
+            clientRoute: {=& passwordResetClientRoute =},
             getPasswordResetEmailContent: _waspGetPasswordResetEmailContent,
         }));
         router.post('/request-password-reset', requestPasswordResetRoute);

package/data/Generator/templates/server/src/auth/providers/email/login.ts

@@ -1,13 +1,13 @@
 import { Request, Response } from 'express';
-import { createInvalidCredentialsError } from 'wasp/auth/utils'
-import { verifyPassword } from 'wasp/auth/password'
+import { createInvalidCredentialsError } from 'wasp/server/auth/utils'
+import { verifyPassword } from 'wasp/server/auth/password'
 import {
     createProviderId,
     findAuthIdentity,
     findAuthWithUserBy,
     getProviderDataWithPassword,
-} from 'wasp/auth/utils'
-import { createSession } from 'wasp/auth/session'
+} from 'wasp/server/auth/utils'
+import { createSession } from 'wasp/server/auth/session'
 import { ensureValidEmail, ensurePasswordIsPresent } from 'wasp/auth/validation'
 import { onBeforeLoginHook, onAfterLoginHook } from '../../hooks.js';
 

package/data/Generator/templates/server/src/auth/providers/email/requestPasswordReset.ts

@@ -4,15 +4,15 @@ import {
     findAuthIdentity,
     doFakeWork,
     getProviderDataWithPassword,
-} from 'wasp/auth/utils';
+} from 'wasp/server/auth/utils';
 import {
+    GetPasswordResetEmailContentFn,
     createPasswordResetLink,
     sendPasswordResetEmail,
     isEmailResendAllowed,
-} from "wasp/server/auth/email/utils";
+} from "wasp/server/auth";
 import { ensureValidEmail } from 'wasp/auth/validation';
 import type { EmailFromField } from 'wasp/server/email/core/types';
-import { GetPasswordResetEmailContentFn } from 'wasp/server/auth/email';
 import { HttpError } from 'wasp/server';
 
 export function getRequestPasswordResetRoute({
@@ -64,7 +64,7 @@ export function getRequestPasswordResetRoute({
                     ...getPasswordResetEmailContent({ passwordResetLink }),
                 },
             );
-        } catch (e: any) {
+        } catch (e: unknown) {
             console.error("Failed to send password reset email:", e);
             throw new HttpError(500, "Failed to send password reset email.");
         }

package/data/Generator/templates/server/src/auth/providers/email/resetPassword.ts

@@ -4,8 +4,9 @@ import {
     findAuthIdentity,
     updateAuthIdentityProviderData,
     getProviderDataWithPassword,
-} from 'wasp/auth/utils';
-import { validateJWT } from 'wasp/auth/jwt'
+} from 'wasp/server/auth/utils';
+import { validateJWT } from 'wasp/server/auth/jwt'
+import { invalidateAllSessionsForAuthId } from 'wasp/server/auth/session'
 import { ensureTokenIsPresent, ensurePasswordIsPresent, ensureValidPassword } from 'wasp/auth/validation';
 import { HttpError } from 'wasp/server';
 
@@ -14,7 +15,9 @@ export async function resetPassword(
     res: Response,
 ): Promise<void> {
     const args = req.body ?? {};
-    ensureValidArgs(args);
+    // NOTE: The token is validated before the password so that an unauthenticated
+    // caller with an invalid token can't learn the deployment's password policy.
+    ensureTokenIsPresent(args);
 
     const { token, password } = args;
     const { email } = await validateJWT<{ email: string }>(token)
@@ -22,6 +25,8 @@ export async function resetPassword(
             throw new HttpError(400, "Password reset failed, invalid token");
         });
 
+    ensureValidPasswordArg(args);
+
     const providerId = createProviderId('email', email);
     const authIdentity = await findAuthIdentity(providerId);
     if (!authIdentity) {
@@ -38,11 +43,14 @@ export async function resetPassword(
         hashedPassword: password,
     });
 
+    // Changing the password invalidates all the existing sessions, so that
+    // somebody who got hold of a session can't keep using it.
+    await invalidateAllSessionsForAuthId(authIdentity.authId);
+
     res.json({ success: true });
 };
 
-function ensureValidArgs(args: object): void {
-    ensureTokenIsPresent(args);
+function ensureValidPasswordArg(args: object): void {
     ensurePasswordIsPresent(args);
     ensureValidPassword(args);
 }

package/data/Generator/templates/server/src/auth/providers/email/signup.ts

@@ -1,28 +1,28 @@
 import { Request, Response } from 'express'
 import type { UserSignupFields } from 'wasp/auth/providers/types'
-import {
-  createProviderId,
-  createUser,
-  deleteUserByAuthId,
-  doFakeWork,
-  findAuthIdentity,
-  getProviderDataWithPassword,
-  rethrowPossibleAuthError,
-  sanitizeAndSerializeProviderData,
-  validateAndGetUserFields,
-} from 'wasp/auth/utils'
 import {
   ensurePasswordIsPresent,
   ensureValidEmail,
   ensureValidPassword,
 } from 'wasp/auth/validation'
 import { HttpError } from 'wasp/server'
-import { GetVerificationEmailContentFn } from 'wasp/server/auth/email'
 import {
+  GetVerificationEmailContentFn,
   createEmailVerificationLink,
   isEmailResendAllowed,
   sendEmailVerificationEmail,
-} from 'wasp/server/auth/email/utils'
+} from 'wasp/server/auth'
+import {
+  createProviderId,
+  createUser,
+  deleteUserByAuthId,
+  doFakeWork,
+  findAuthIdentity,
+  getProviderDataWithPassword,
+  rethrowPossibleAuthError,
+  sanitizeAndSerializeProviderData,
+  validateAndGetUserFields,
+} from 'wasp/server/auth/utils'
 import { EmailFromField } from 'wasp/server/email/core/types'
 import { onAfterSignupHook, onBeforeSignupHook } from '../../hooks.js'
 
@@ -91,7 +91,7 @@ export function getSignupRoute({
       // we are not checking if the email was sent or not!
       const { isResendAllowed, timeLeft } = isEmailResendAllowed(
         providerData,
-        'passwordResetSentAt',
+        'emailVerificationSentAt',
       )
       if (!isResendAllowed) {
         throw new HttpError(
@@ -107,6 +107,14 @@ export function getSignupRoute({
       }
     }
 
+    // The hook runs first so it can veto the signup (by throwing) before the
+    // developer's `userSignupFields` getters run.
+    try {
+      await onBeforeSignupHook({ req, providerId })
+    } catch (e: unknown) {
+      rethrowPossibleAuthError(e)
+    }
+
     const userFields = await validateAndGetUserFields(fields, userSignupFields)
 
     const newUserProviderData = await sanitizeAndSerializeProviderData<'email'>(
@@ -119,7 +127,6 @@ export function getSignupRoute({
     )
 
     try {
-      await onBeforeSignupHook({ req, providerId })
       const user = await createUser(
         providerId,
         newUserProviderData,
@@ -139,14 +146,18 @@ export function getSignupRoute({
       return
     }
 
+    // We send the verification link to the normalized address that we stored.
+    // This way the address that proves ownership is the same one password reset later
+    // sends the reset link to.
+    const email = providerId.providerUserId
     const verificationLink = await createEmailVerificationLink(
-      fields.email,
+      email,
       clientRoute,
     )
     try {
-      await sendEmailVerificationEmail(fields.email, {
+      await sendEmailVerificationEmail(email, {
         from: fromField,
-        to: fields.email,
+        to: email,
         ...getVerificationEmailContent({ verificationLink }),
       })
     } catch (e: unknown) {

package/data/Generator/templates/server/src/auth/providers/email/verifyEmail.ts

@@ -1,12 +1,13 @@
 import { Request, Response } from 'express';
-import { validateJWT } from 'wasp/auth/jwt';
+import { validateJWT } from 'wasp/server/auth/jwt';
 import {
+  createInvalidCredentialsError,
   createProviderId,
   findAuthIdentity,
   findAuthWithUserBy,
   getProviderDataWithPassword,
   updateAuthIdentityProviderData,
-} from 'wasp/auth/utils';
+} from 'wasp/server/auth/utils';
 import { HttpError } from 'wasp/server';
 import { onAfterEmailVerifiedHook } from '../../hooks.js';
 
@@ -35,6 +36,10 @@ export async function verifyEmail(
 
     const auth = await findAuthWithUserBy({ id: authIdentity.authId })
 
+    if (auth === null) {
+        throw createInvalidCredentialsError();
+    }
+
     await onAfterEmailVerifiedHook({ req, email, user: auth.user });
 
     res.json({ success: true });

package/data/Generator/templates/server/src/auth/providers/oauth/cookies.ts

@@ -19,6 +19,10 @@ export function setOAuthCookieValue(
   res.cookie(cookieName, value, {
     httpOnly: true,
     secure: !config.isDevelopment,
+    // The OAuth callback is a top-level GET navigation, which `lax` permits.
+    // We set it explicitly because an omitted `sameSite` is not `lax` in every
+    // browser.
+    sameSite: "lax",
     path: "/",
     maxAge: 60 * 60 * 1000, // 1 hour
   });
@@ -28,7 +32,7 @@ export function getOAuthCookieValue(
   provider: ProviderConfig,
   req: ExpressRequest,
   fieldName: OAuthStateFieldName,
-): string {
+): string | undefined {
   const cookieName = `${provider.id}_${fieldName}`;
   const cookies = parseCookies(req.headers.cookie ?? "");
   return cookies.get(cookieName);

package/data/Generator/templates/server/src/auth/providers/oauth/handler.ts

@@ -1,7 +1,7 @@
 import { Router } from 'express'
 
 import { defineHandler, redirect } from 'wasp/server/utils'
-import { rethrowPossibleAuthError } from 'wasp/auth/utils'
+import { rethrowPossibleAuthError } from 'wasp/server/auth/utils'
 import {
   type UserSignupFields,
   type ProviderConfig,

package/data/Generator/templates/server/src/auth/providers/oauth/oneTimeCode.ts

@@ -2,8 +2,8 @@ import { Router } from "express";
 
 import { HttpError } from 'wasp/server';
 import { defineHandler } from 'wasp/server/utils';
-import { findAuthWithUserBy } from 'wasp/auth/utils'
-import { createSession } from 'wasp/auth/session'
+import { findAuthWithUserBy } from 'wasp/server/auth/utils'
+import { createSession } from 'wasp/server/auth/session'
 import { exchangeCodeForTokenPath, tokenStore } from "wasp/server/auth";
 
 export function setupOneTimeCodeRoute(router: Router) {

package/data/Generator/templates/server/src/auth/providers/oauth/state.ts

@@ -5,6 +5,7 @@ import {
 import * as arctic from 'arctic';
 
 import type { ProviderConfig } from 'wasp/auth/providers/types';
+import { HttpError } from 'wasp/server';
 
 import { setOAuthCookieValue, getOAuthCookieValue } from './cookies.js';
 
@@ -68,15 +69,16 @@ export function validateAndGetOAuthState<OT extends OAuthType>({
   provider: ProviderConfig,
   req: ExpressRequest
 }): OAuthStateWithCodeFor<OT> {
-  const state: OAuthStateWithCodeFor<OT> = {
-    ...getCode(req),
+  const state: OAuthStateFor<OT> = {
     ...getState(req),
     ...(oAuthType === 'OAuth2WithPKCE' && getCodeVerifier(provider, req)),
   };
 
+  // We validate the state before reading anything else from the callback,
+  // so only a callback for a login this browser started gets handled.
   validateOAuthState(provider, req, state);
 
-  return state;
+  return { ...state, ...getCode(provider, req) };
 }
 
 function storeOAuthState(
@@ -93,22 +95,27 @@ function storeOAuthState(
 function validateOAuthState(
   provider: ProviderConfig,
   req: ExpressRequest,
-  state: OAuthStateWithCodeFor<OAuthType>
+  state: OAuthStateFor<OAuthType>
 ): void {
-  if (typeof state.code !== 'string') {
-    throw new Error('Invalid code');
-  }
-
+  // This fails when the login outlived the cookies, was finished in a
+  // different browser, or was replaced by a newer login attempt.
   const storedState = getOAuthCookieValue(provider, req, 'state');
   if (!state.state || !storedState || storedState !== state.state) {
-    throw new Error('Invalid state');
+    throw createLoginExpiredError(provider);
   }
 
   if (isOAuthStateWithPKCE(state) && !state.codeVerifier) {
-    throw new Error('Missing code verifier');
+    throw createLoginExpiredError(provider);
   }
 }
 
+function createLoginExpiredError(provider: ProviderConfig): HttpError {
+  return new HttpError(
+    400,
+    `Your login attempt with ${provider.displayName} expired. Please try again.`
+  );
+}
+
 function generateState(): { state: string } {
   return { state: arctic.generateState() };
 }
@@ -117,8 +124,39 @@ function generateCodeVerifier(): { codeVerifier: string } {
   return { codeVerifier: arctic.generateCodeVerifier() };
 }
 
-function getCode(req: ExpressRequest): { code: string } {
-  return { code: `${req.query.code}` };
+function getCode(
+  provider: ProviderConfig,
+  req: ExpressRequest
+): { code: string } {
+  const { code, error, error_description } = req.query;
+
+  // The provider's error is meant for developers, so we only log it (the
+  // handler logs `data`) and never show it to the user.
+  const providerErrorDetails = {
+    providerError: error,
+    providerErrorDescription: error_description,
+  };
+
+  // Providers send `access_denied` when the user cancels on the consent screen,
+  // but some (e.g. Keycloak, Auth0) also send it when their own policy denies
+  // the login.
+  if (error === 'access_denied') {
+    throw new HttpError(
+      400,
+      `Login with ${provider.displayName} was cancelled or denied.`,
+      providerErrorDetails
+    );
+  }
+
+  if (error !== undefined || typeof code !== 'string' || code === '') {
+    throw new HttpError(
+      400,
+      `Unable to log in with ${provider.displayName}. Please try again later.`,
+      providerErrorDetails
+    );
+  }
+
+  return { code };
 }
 
 function getState(req: ExpressRequest): { state: string } {
@@ -134,7 +172,11 @@ function getCodeVerifier(
     req,
     'codeVerifier'
   );
-  return { codeVerifier };
+  // The cookie can be missing (dropped by the browser, or expired while the user
+  // sat on the consent screen). `validateOAuthState` rejects an empty code
+  // verifier, so we normalize the missing case into one instead of lying about
+  // the type.
+  return { codeVerifier: codeVerifier ?? '' };
 }
 
 function isOAuthStateWithPKCE(

package/data/Generator/templates/server/src/auth/providers/oauth/user.ts

@@ -7,7 +7,7 @@ import {
   validateAndGetUserFields,
   createProviderId,
   findAuthWithUserBy,
-} from 'wasp/auth/utils'
+} from 'wasp/server/auth/utils'
 import { type {= authEntityUpper =} } from 'wasp/entities'
 import { prisma } from 'wasp/server'
 import { type UserSignupFields, type ProviderConfig } from 'wasp/auth/providers/types'
@@ -111,6 +111,10 @@ async function getAuthIdFromProviderDetails({
 
     return authId
   } else {
+    // The hook runs first so it can veto the signup (by throwing) before the
+    // developer's `userSignupFields` getters run.
+    await onBeforeSignupHook({ req, providerId })
+
     const userFields = await validateAndGetUserFields(
       { profile: providerProfile },
       userSignupFields,
@@ -118,8 +122,7 @@ async function getAuthIdFromProviderDetails({
 
     // For now, we don't have any extra data for the oauth providers, so we just pass an empty object.
     const providerData = await sanitizeAndSerializeProviderData({})
-  
-    await onBeforeSignupHook({ req, providerId })
+
     const user = await createUser(
       providerId,
       providerData,

package/data/Generator/templates/server/src/auth/providers/username/login.ts

@@ -1,15 +1,15 @@
 {{={= =}=}}
-import { createInvalidCredentialsError } from 'wasp/auth/utils'
+import { createInvalidCredentialsError } from 'wasp/server/auth/utils'
 import { defineHandler } from 'wasp/server/utils'
-import { verifyPassword } from 'wasp/auth/password'
+import { verifyPassword } from 'wasp/server/auth/password'
 
 import {
   createProviderId,
   findAuthIdentity,
   findAuthWithUserBy,
   getProviderDataWithPassword,
-} from 'wasp/auth/utils'
-import { createSession } from 'wasp/auth/session'
+} from 'wasp/server/auth/utils'
+import { createSession } from 'wasp/server/auth/session'
 import { ensureValidUsername, ensurePasswordIsPresent } from 'wasp/auth/validation'
 import { onBeforeLoginHook, onAfterLoginHook } from '../../hooks.js';
 

package/data/Generator/templates/server/src/auth/providers/username/signup.ts

@@ -5,13 +5,13 @@ import {
   createUser,
   rethrowPossibleAuthError,
   sanitizeAndSerializeProviderData,
-} from 'wasp/auth/utils'
+} from 'wasp/server/auth/utils'
 import {
   ensureValidUsername,
   ensurePasswordIsPresent,
   ensureValidPassword,
 } from 'wasp/auth/validation'
-import { validateAndGetUserFields } from 'wasp/auth/utils'
+import { validateAndGetUserFields } from 'wasp/server/auth/utils'
 import type { UserSignupFields } from 'wasp/auth/providers/types'
 import { onBeforeSignupHook, onAfterSignupHook } from '../../hooks.js';
 
@@ -24,18 +24,26 @@ export function getSignupRoute({
     const fields = req.body ?? {}
     ensureValidArgs(fields)
 
+    const providerId = createProviderId('username', fields.username)
+
+    // The hook runs first so it can veto the signup (by throwing) before the
+    // developer's `userSignupFields` getters run.
+    try {
+      await onBeforeSignupHook({ req, providerId })
+    } catch (e: unknown) {
+      rethrowPossibleAuthError(e)
+    }
+
     const userFields = await validateAndGetUserFields(
       fields,
       userSignupFields,
     );
 
-    const providerId = createProviderId('username', fields.username)
     const providerData = await sanitizeAndSerializeProviderData<'username'>({
       hashedPassword: fields.password,
     })
 
     try {
-      await onBeforeSignupHook({ req, providerId })
       const user = await createUser(
         providerId,
         providerData,

package/data/Generator/templates/server/src/createRollupBundle.js

@@ -0,0 +1,47 @@
+import resolve from "@rollup/plugin-node-resolve";
+import esbuild from "rollup-plugin-esbuild";
+import { virtualUserModules } from "./plugins/virtualUserModules.js";
+
+/**
+ * @param {string} inputFilePath
+ * @param {string} outputFilePath
+ * @returns {import("rollup").RollupOptions}
+ */
+export function createRollupBundle(inputFilePath, outputFilePath) {
+  return {
+    input: inputFilePath,
+    output: {
+      file: outputFilePath,
+      format: "es",
+      sourcemap: true,
+    },
+    plugins: [
+      virtualUserModules(),
+      // We added `".ts"` to the default `extensions` array value
+      // (default is `[".mjs", ".js", ".json", ".node"]`).
+      // This is because the `virtualUserModules` plugin
+      // can resolve user virtual modules to TypeScript files.
+      resolve({ extensions: [".mjs", ".js", ".ts", ".json", ".node"] }),
+      esbuild({
+        target: "esnext",
+      }),
+    ],
+    // We don't want to bundle any of the node_module deps because we want to
+    // keep them as external dependencies.
+    external: /node_modules/,
+    // 'preserveSymlinks: false' tells Rollup to fully follow symlinks when
+    // resolving modules. This is the default option, but we're setting it
+    // explicitly because we rely on it.
+    //
+    // With this set to 'false', the 'wasp' package resolves to
+    // '.wasp/out/sdk/wasp' (not 'node_modules/wasp'), preventing Rollup from
+    // viewing it as an external dependency and ensuring it gets bundled.
+    //
+    // We need to bundle 'wasp' to support fully extensionless relative
+    // imports. See https://github.com/wasp-lang/wasp/issues/2492 for more
+    // details.
+    //
+    // Source: https://rollupjs.org/configuration-options/#preservesymlinks
+    preserveSymlinks: false,
+  }
+}

package/data/Generator/templates/server/src/crud/_operations.ts

@@ -2,23 +2,23 @@
 import { prisma } from 'wasp/server'
 
 {=# isAuthEnabled =}
-import { createInvalidCredentialsError } from 'wasp/auth/utils'
+import { createInvalidCredentialsError } from 'wasp/server/auth/utils'
 {=/ isAuthEnabled =}
 import type {
   {=# crud.operations.GetAll =}
-  GetAllQueryResolved,
+  RegisteredGetAllQuery,
   {=/ crud.operations.GetAll =}
   {=# crud.operations.Get =}
-  GetQueryResolved,
+  RegisteredGetQuery,
   {=/ crud.operations.Get =}
   {=# crud.operations.Create =}
-  CreateActionResolved,
+  RegisteredCreateAction,
   {=/ crud.operations.Create =}
   {=# crud.operations.Update =}
-  UpdateActionResolved,
+  RegisteredUpdateAction,
   {=/ crud.operations.Update =}
   {=# crud.operations.Delete =}
-  DeleteActionResolved,
+  RegisteredDeleteAction,
   {=/ crud.operations.Delete =}
 } from 'wasp/server/crud/{= crud.name =}'
 {=# overrides.GetAll.isDefined =}
@@ -50,7 +50,7 @@ const entities = {
 // 1. We either use the default implementation of the operation...
 =}
 {=^ overrides.GetAll.isDefined =}
-const _waspGetAllQuery: GetAllQueryResolved = ((args, context) => {
+const _waspGetAllQuery: RegisteredGetAllQuery = ((args, context) => {
   {=^ crud.operations.GetAll.isPublic =}
   throwIfNotAuthenticated(context)
   {=/ crud.operations.GetAll.isPublic =}
@@ -78,11 +78,11 @@ export async function getAllFn(args, context) {
 {=!
 // That's it! It is similar for all other operations.
 =}  
-
 {=# crud.operations.Get =}
+
 // Get query
 {=^ overrides.Get.isDefined =}
-const _waspGetQuery: GetQueryResolved = ((args, context) => {
+const _waspGetQuery: RegisteredGetQuery = ((args, context) => {
   {=^ crud.operations.Get.isPublic =}
   throwIfNotAuthenticated(context)
   {=/ crud.operations.Get.isPublic =}
@@ -100,11 +100,11 @@ export async function getFn(args, context) {
   });
 }
 {=/ crud.operations.Get =}
-
 {=# crud.operations.Create =}
+
 // Create action
 {=^ overrides.Create.isDefined =}
-const _waspCreateAction: CreateActionResolved = ((args, context) => {
+const _waspCreateAction: RegisteredCreateAction = ((args, context) => {
   {=^ crud.operations.Create.isPublic =}
   throwIfNotAuthenticated(context)
   {=/ crud.operations.Create.isPublic =}
@@ -122,11 +122,11 @@ export async function createFn(args, context) {
   });
 }
 {=/ crud.operations.Create =}
-
 {=# crud.operations.Update =}
+
 // Update action
 {=^ overrides.Update.isDefined =}
-const _waspUpdateAction: UpdateActionResolved = ((args, context) => {
+const _waspUpdateAction: RegisteredUpdateAction = ((args, context) => {
   {=^ crud.operations.Update.isPublic =}
   throwIfNotAuthenticated(context)
   {=/ crud.operations.Update.isPublic =}
@@ -148,11 +148,11 @@ export async function updateFn(args, context) {
   });
 }
 {=/ crud.operations.Update =}
-
 {=# crud.operations.Delete =}
+
 // Delete action
 {=^ overrides.Delete.isDefined =}
-const _waspDeleteAction: DeleteActionResolved = ((args, context) => {
+const _waspDeleteAction: RegisteredDeleteAction = ((args, context) => {
   {=^ crud.operations.Delete.isPublic =}
   throwIfNotAuthenticated(context)
   {=/ crud.operations.Delete.isPublic =}
@@ -181,4 +181,4 @@ function throwIfNotAuthenticated (context) {
   {=^ isAuthEnabled =}
   // Auth is not enabled
   {=/ isAuthEnabled =}
-}
+}