auth-setup.ts

import process from "node:process";
import crypto from "node:crypto";
import { createClient } from "edgedb";

const client = createClient();

type AuthConfig = {
  token_time_to_live: string;
  providers: {
    name: string;
    url: string | null;
    secret: string | null;
    client_id: string | null;
  }[];
  ui: {
    redirect_to: string;
    redirect_to_on_signup: string;
    app_name: string;
    logo_url: string;
    dark_logo_url: string;
    brand_color: string;
  } | null;
};

async function main() {
  const inquirer = (await import("inquirer")).default;
  const existingConfig = await client.queryRequiredSingle<AuthConfig>(`
SELECT cfg::Config.extensions[is ext::auth::AuthConfig] {
  *,
  providers: {
    name,
    [is ext::auth::OAuthProviderConfig].*,
  },
  ui: { * },
} limit 1
  `);

  if (existingConfig.providers.length > 0) {
    console.warn(
      `Auth is already configured with the following values:
${JSON.stringify(existingConfig, null, 2)}`,
    );
  }

  const questions = [
    {
      type: "input",
      name: "appName",
      message: "Enter the app name:",
    },
    {
      type: "input",
      name: "authSigningKey",
      message: "Enter the signing key:",
      default: crypto.randomBytes(32).toString("hex"),
      validate: (val: string) =>
        val.length >= 32 || "The key must be at least 32 bytes long",
    },
    {
      type: "input",
      name: "tokenTTL",
      message: "Enter the token time to live:",
      default: existingConfig.token_time_to_live.toString() ?? "336 hours",
    },
    {
      type: "checkbox",
      name: "providers",
      message: "Would you like to enable any of the following OAuth providers?",
      choices: ["github", "google", "azure", "apple", "discord", "slack"],
      default:
        existingConfig.providers.map(
          (provider) => provider.name.split("::")[1] ?? null,
        ) ?? [],
    },
    {
      type: "confirm",
      name: "enableHostedUI",
      message: "Would you like to enable the hosted Auth UI?",
    },
    {
      type: "confirm",
      name: "enablePasswordAuth",
      message: "Would you like to enable local password authentication?",
    },
    {
      type: "confirm",
      name: "enableMagicLink",
      message: "Would you like to enable magic link email authentication?",
    },
    {
      type: "confirm",
      name: "enableWebAuthn",
      message: "Would you like to enable WebAuthn authentication?",
    },
    {
      type: "confirm",
      name: "enableSmtp",
      message: "Would you like to enable SMTP?",
    },
  ];

  const answers = await inquirer.prompt(questions);

  const providersDetails: [string, any][] = [];
  for (const provider of answers.providers) {
    const existingProvider = existingConfig.providers.find(
      (p) => p.name === provider,
    );
    const providerDetails = await inquirer.prompt([
      {
        type: "input",
        name: "clientId",
        message: `Enter the ${provider} client ID:`,
        default: existingProvider?.client_id,
      },
      {
        type: "input",
        name: "secret",
        message: `Enter the ${provider} secret:`,
        default: existingProvider?.secret,
      },
    ]);
    providersDetails.push([provider, providerDetails]);
  }

  let query = `
    CONFIGURE CURRENT DATABASE
    RESET ext::auth::ProviderConfig;

    CONFIGURE CURRENT DATABASE
    RESET ext::auth::AuthConfig;

    CONFIGURE CURRENT DATABASE
    RESET ext::auth::UIConfig;

    CONFIGURE CURRENT DATABASE
    RESET ext::auth::SMTPConfig;

    CONFIGURE CURRENT DATABASE SET
    ext::auth::AuthConfig::auth_signing_key := '${answers.authSigningKey}';
  `;

  if (answers.tokenTTL) {
    query += `
      CONFIGURE CURRENT DATABASE SET
      ext::auth::AuthConfig::token_time_to_live := <duration>'${answers.tokenTTL}';
    `;
  }

  const PROVIDER_MAP: Record<string, string> = {
    github: "GitHubOAuthProvider",
    google: "GoogleOAuthProvider",
    apple: "AppleOAuthProvider",
    azure: "AzureOAuthProvider",
    discord: "DiscordOAuthProvider",
    slack: "SlackOAuthProvider",
  };

  for (const [provider, providerDetails] of providersDetails) {
    const providerType = PROVIDER_MAP[provider];
    query += `
      CONFIGURE CURRENT DATABASE
      INSERT ext::auth::${providerType} {
        secret := '${providerDetails.secret}',
        client_id := '${providerDetails.clientId}'
      };
    `;
  }

  if (answers.enablePasswordAuth) {
    const passwordAuthConfig = await inquirer.prompt([
      {
        type: "confirm",
        name: "requireVerification",
        message: "Should email/password require email verification?",
      },
    ]);
    query += `
      CONFIGURE CURRENT DATABASE
      INSERT ext::auth::EmailPasswordProviderConfig {
        require_verification := <bool>${passwordAuthConfig.requireVerification}
      };
    `;
  }

  if (answers.enableMagicLink) {
    const magicLinkAuthConfig = await inquirer.prompt([
      {
        type: "input",
        name: "tokenTTL",
        message:
          "How long should the email sign-in link be valid for? (ISO Duration format)?",
        default: "PT10M",
      },
    ]);
    query += `
      CONFIGURE CURRENT DATABASE
      INSERT ext::auth::MagicLinkProviderConfig {
        token_time_to_live := <duration>'${magicLinkAuthConfig.tokenTTL}',
      };
    `;
  }

  if (answers.enableWebAuthn) {
    const webAuthnConfig = await inquirer.prompt([
      {
        type: "confirm",
        name: "requireVerification",
        message: "Should WebAuthn require email verification?",
      },
      {
        type: "input",
        name: "relyingPartyOrigin",
        message: "Enter the relying party origin:",
        default: "http://localhost:3000",
      },
    ]);
    query += `
      CONFIGURE CURRENT DATABASE
      INSERT ext::auth::WebAuthnProviderConfig {
        relying_party_origin := '${webAuthnConfig.relyingPartyOrigin}',
        require_verification := <bool>${webAuthnConfig.requireVerification}
      };
    `;
  }

  if (answers.enableHostedUI) {
    const hostedUi = await inquirer.prompt([
      {
        type: "input",
        name: "redirectTo",
        message: "Enter the redirect URL:",
        default:
          existingConfig.ui?.redirect_to ??
          "http://localhost:3000/auth/builtin/callback",
        required: true,
      },
      {
        type: "input",
        name: "redirectToOnSignup",
        message: "Enter the redirect URL on signup:",
        default:
          existingConfig.ui?.redirect_to_on_signup ??
          "http://localhost:3000/auth/builtin/callback?isSignUp=true",
        required: false,
      },
      {
        type: "input",
        name: "brandColor",
        message: "Enter the brand color:",
        default: existingConfig.ui?.brand_color ?? "#000000",
        required: false,
      },
      {
        type: "input",
        name: "logo_url",
        message: "Enter the brand logo",
        default:
          existingConfig.ui?.logo_url ??
          "https://avatars.githubusercontent.com/u/14262913",
      },
    ]);

    query += `
      CONFIGURE CURRENT DATABASE
      INSERT ext::auth::UIConfig {
        redirect_to := '${hostedUi.redirectTo}',
        redirect_to_on_signup := '${hostedUi.redirectToOnSignup ?? hostedUi.redirectTo}',
        app_name := '${answers.appName}',
        brand_color := '${hostedUi.brandColor}',
        logo_url := '${hostedUi.logo_url}',
      };
    `;
  }

  if (answers.enableSmtp) {
    const smtpConfig = await inquirer.prompt([
      {
        type: "input",
        name: "sender",
        message: "Sender email:",
        required: true,
      },
      {
        type: "input",
        name: "host",
        message: "SMTP Host:",
        default: "localhost",
        required: true,
      },
      {
        type: "number",
        name: "port",
        message: "SMTP Port:",
        default: 1025,
        required: true,
      },
      {
        type: "input",
        name: "username",
        message: "SMTP Username:",
      },
      {
        type: "input",
        name: "password",
        message: "SMTP Password:",
      },
      {
        type: "list",
        name: "security",
        message: "SMTP security mode:",
        choices: ["STARTTLSOrPlainText", "STARTTLS", "TLS", "PlainText"],
        default: "TLS",
      },
      {
        type: "confirm",
        name: "validate_certs",
        message: "Should we validate SMTP certificates?",
        default: false,
      },
    ]);
    query += `
      CONFIGURE CURRENT DATABASE SET
      ext::auth::SMTPConfig::sender := '${smtpConfig.sender}';

      CONFIGURE CURRENT DATABASE SET
      ext::auth::SMTPConfig::host := '${smtpConfig.host}';

      CONFIGURE CURRENT DATABASE SET
      ext::auth::SMTPConfig::port := <int32>${smtpConfig.port};

      CONFIGURE CURRENT DATABASE SET
      ext::auth::SMTPConfig::username := '${smtpConfig.username}';

      CONFIGURE CURRENT DATABASE SET
      ext::auth::SMTPConfig::password := '${smtpConfig.password}';

      CONFIGURE CURRENT DATABASE SET
      ext::auth::SMTPConfig::security := '${smtpConfig.security}';

      CONFIGURE CURRENT DATABASE SET
      ext::auth::SMTPConfig::validate_certs := <bool>${smtpConfig.validate_certs};
    `;
  }

  console.log("The following query will be executed:\n", query);
  const confirm = await inquirer.prompt({
    type: "confirm",
    name: "execute",
    message: "Do you want to execute this query?",
  });

  if (confirm.execute) {
    await client.execute(query);
  } else {
    return;
  }
}

main()
  .then(() => process.exit(0))
  .catch((err: Error) => {
    console.error(err);
    process.exit(1);
  });