WIP: setup auth <npm-package> #7430

Tobbe · 2023-01-22T22:26:32Z

This PR adds the ability to set up auth using any setup package that's published to npm. It supports both npm-package and npm-package@version to install the latest version or the specific version given.

Open issue on yargs about a problem I'm running in to:
yargs/yargs#2291

replay-io · 2023-01-22T22:37:37Z

16 replays were recorded for 24c0729.

0 Failed

16 Passed

requireAuth graphql checks

locator.waitFor: Target closed
=========================== logs ===========================
waiting for locator('.rw-form-error-title').locator('text=You don\'t have permission to do that') to be visible
============================================================

useAuth hook, auth redirects checks
Check that tags are rendering the correct dynamic data
Check that a specific blog post is prerendered
Check that about is prerendered
Check that homepage is prerendered
Check that you can navigate from home page to specific blog post
Waterfall prerendering (nested cells)
RBAC: Admin user should be able to delete contacts
RBAC: Should not be able to delete contact as non-admin user
Smoke test with dev server
Smoke test with rw serve
Loads Cell mocks when Cell is nested in another story
Loads Cell Stories
Loads MDX Stories
Mocks current user, and updates UI while dev server is running

View test run on Replay ↗︎

packages/cli/src/commands/setup/auth/auth.js

dac09 · 2023-01-26T06:35:40Z

Hey Tobbe, just a reminder we need to be careful about allowing any packages to be installed!

IMO, plugins to setup anything (auth or otherwise) needs to be an active step, such as enabling a list of plugins in the toml, or via CLI. e.g.

yarn rw plugin add redwood-auth-bazinga

Which would prompt and confirm the addition to a redwood.toml, and install a package to the root package.json. You also have the option of checking version compatibility at this point.

+[plugins]
+ - redwood-auth-bazinga

This creates a path to extract not only auth, but other setup commands too - and potentially opens up "hooks" in our cli. It would reduce the chance that a user installs a mailicious package, but also avoids the need to pull things off the internet during the setup process (since the package is locally installed at this point)

I described the concept here: #2086 (comment)

Tobbe · 2023-01-26T08:04:49Z

@dac09 When we do plugins we probably need to discuss the dx more with the team. For now I'm trying to keep the scope small and just do something for auth.

Tobbe · 2023-01-26T16:35:30Z

Danny and I talked. We decided we need to do something to protect users from just installing some random package not realizing it might be a good idea. Better be too strict now, and loosen up later, than the other way around after something bad has already happened. One idea was to prompt users when setting up auth using a package that's not from @redwoodjs/*

jtoar

Still reviewing, but will post one comment while I have it: tried yarn rw setup auth @redwoodjs/auth-gotrue and it doesn't seem to work quite yet, I think because @redwoodjs/auth-gotrue isn't a package—it's just a prefix (the real packages are @redwoodjs/auth-gotrue-{api,web,setup}.

output

dom@evaM1 ~/p/r/redwood-app (prs/setup-auth) [1]> yarn rw setup auth @redwoodjs/auth-gotrue

Set up auth using @redwoodjs/auth-gotrue

rw setup auth

Commands:
  rw setup auth build [side..]          Build for production
  rw setup auth check                   Get structural diagnostics for a Redwood
                                        project (experimental)
                                                          [aliases: diagnostics]
  rw setup auth console                 Launch an interactive Redwood shell
                                        (experimental)              [aliases: c]
  rw setup auth data-migrate <command>  Migrate the data in your database
                                                      [aliases: dm, dataMigrate]
  rw setup auth deploy <target>         Deploy your Redwood project
  rw setup auth destroy <type>          Rollback changes made by the generate
                                        command                     [aliases: d]
  rw setup auth dev [side..]            Start development servers for api, and
                                        web
  rw setup auth exec [name]             Run scripts generated with yarn generate
                                        script
  rw setup auth generate <type>         Generate boilerplate code and type
                                        definitions                 [aliases: g]
  rw setup auth info                    Print your system environment
                                        information
  rw setup auth lint [path..]           Lint your files
  rw setup auth prerender               Prerender pages of your Redwood app at
                                        build time             [aliases: render]
  rw setup auth prisma [commands..]     Run Prisma CLI with experimental
                                        features
  rw setup auth record <command>        Setup RedwoodRecord for your project.
                                        Caches a JSON version of your data model
                                        and adds api/src/models/index.js with
                                        some config.
  rw setup auth serve [side]            Run server for api or web in production
  rw setup auth setup <command>         Initialize project config and install
                                        packages
  rw setup auth storybook               Launch Storybook: a tool for building UI
                                        components and pages in isolation
                                                                   [aliases: sb]
  rw setup auth test [filter..]         Run Jest tests. Defaults to watch mode
  rw setup auth ts-to-js                Convert a TypeScript project to
                                        JavaScript
  rw setup auth type-check [sides..]    Run a TypeScript compiler check on your
                                        project               [aliases: tsc, tc]
  rw setup auth upgrade                 Upgrade all @redwoodjs packages via
                                        interactive CLI

Options:
  --help     Show help                                                 [boolean]
  --version  Show version number                                       [boolean]
  --cwd      Working directory to use (where `redwood.toml` is located)

Examples:
  yarn rw g page home /  "Create a page component named 'Home' at path '/'"

Error: Command failed with exit code 1: yarn npm info @redwoodjs/auth-gotrue --fields versions --json
{"type":"error","name":35,"displayName":"YN0035","indent":"","data":"The remote server failed to provide the requested resource"}
{"type":"error","name":35,"displayName":"YN0035","indent":"","data":"  Response Code: 404 (Not Found)"}
{"type":"error","name":35,"displayName":"YN0035","indent":"","data":"  Request Method: GET"}
{"type":"error","name":35,"displayName":"YN0035","indent":"","data":"  Request URL: https://registry.yarnpkg.com/@redwoodjs%2fauth-gotrue"}
    at makeError (/Users/dom/prjcts/redwood/redwood-app/node_modules/execa/lib/error.js:60:11)
    at Function.module.exports.sync (/Users/dom/prjcts/redwood/redwood-app/node_modules/execa/index.js:194:17)
    at Function.module.exports.commandSync (/Users/dom/prjcts/redwood/redwood-app/node_modules/execa/index.js:235:15)
    at getLatestAuthSetup (/Users/dom/prjcts/redwood/redwood-app/node_modules/@redwoodjs/cli/dist/commands/setup/auth/auth.js:218:22)
    at getAuthSetup (/Users/dom/prjcts/redwood/redwood-app/node_modules/@redwoodjs/cli/dist/commands/setup/auth/auth.js:206:10)
    at Object.handler (/Users/dom/prjcts/redwood/redwood-app/node_modules/@redwoodjs/cli/dist/commands/setup/auth/auth.js:137:15)
    at /Users/dom/prjcts/redwood/redwood-app/node_modules/yargs/build/index.cjs:1:8891
    at /Users/dom/prjcts/redwood/redwood-app/node_modules/yargs/build/index.cjs:1:4949 {
  shortMessage: 'Command failed with exit code 1: yarn npm info @redwoodjs/auth-gotrue --fields versions --json',
  command: 'yarn npm info @redwoodjs/auth-gotrue --fields versions --json',
  escapedCommand: 'yarn npm info "@redwoodjs/auth-gotrue" --fields versions --json',
  exitCode: 1,
  signal: undefined,
  signalDescription: undefined,
  stdout: '{"type":"error","name":35,"displayName":"YN0035","indent":"","data":"The remote server failed to provide the requested resource"}\n' +
    '{"type":"error","name":35,"displayName":"YN0035","indent":"","data":"  Response Code: 404 (Not Found)"}\n' +
    '{"type":"error","name":35,"displayName":"YN0035","indent":"","data":"  Request Method: GET"}\n' +
    '{"type":"error","name":35,"displayName":"YN0035","indent":"","data":"  Request URL: https://registry.yarnpkg.com/@redwoodjs%2fauth-gotrue"}',
  stderr: '',
  failed: true,
  timedOut: false,
  isCanceled: false,
  killed: false
}

jtoar · 2023-03-15T20:21:02Z

packages/cli/src/commands/setup/auth/auth.js

+
+async function getLatestAuthSetup(module, ignoreScripts) {
+  const { stdout } = execa.commandSync(
+    `yarn npm info ${module} --fields versions --json`


This is where the command failed when I tried it, because @redwoodjs/auth-gotrue isn't a package

jtoar · 2023-03-15T20:39:27Z

packages/cli/src/commands/setup/auth/auth.js

+      () => {},
+      async () => {
+        // Here be dragons...
+        // There's no way for the user to actually end up here, but we need
+        // this command to get the help output we want from yargs
+      }


The help still seems to show when I remove the builder and handler here (() => {} and async () => {}); doesn't seem to matter if we leave them in or not, but the .command() is definitely necessary. But maybe we could move the comment up to before .command() to reflect that?

jtoar · 2023-03-15T20:40:15Z

packages/cli/src/commands/setup/auth/auth.js

+        // This is a workaround for https://github.com/yargs/yargs/issues/2291
+        if (args._.length <= 2) {
+          let helpCmd = 'yarn rw setup auth --help'
+
+          if (/cli[\/\\]dist[\/\\]index.js/.test(process.argv[1])) {
+            helpCmd = 'yarn dev setup auth --help'
+          }
+
+          console.error(execa.commandSync(helpCmd).stdout)
+          process.exit(1)
+        }


Do we still need this block now that that issue you linked to is closed?

jtoar · 2023-03-15T20:42:36Z

packages/cli/src/commands/setup/auth/auth.js

+      () => {},
+      async (args) => {
+        // This is a workaround for https://github.com/yargs/yargs/issues/2291
+        if (args._.length <= 2) {


Would it ever just not be 2? This handles the case where the user does yarn rw setup auth right? Or maybe you're handling yarn dev here?

jtoar · 2023-10-06T15:55:58Z

Superseded by #8920

WIP: setup auth --list

67bf9f9

Tobbe added 2 commits January 23, 2023 22:45

fetch package list from npm

6122bbb

setup auth using npm package

1d1ddf8

Tobbe force-pushed the tobbe-setup-auth-list branch from 8c78b60 to 1d1ddf8 Compare January 25, 2023 19:57

github-advanced-security bot found potential problems Jan 25, 2023

View reviewed changes

packages/cli/src/commands/setup/auth/auth.js Fixed Show fixed Hide fixed

Tobbe added 4 commits January 26, 2023 00:19

Remove listing all auth providers on npm

d4efbe1

Merge branch 'main' into tobbe-setup-auth-list

1c710a3

Remove unused imports

bbd2164

Rebuild test-project

9183772

Tobbe added the release:feature This PR introduces a new feature label Jan 25, 2023

Merge branch 'main' into tobbe-setup-auth-list

020efb0

Tobbe changed the title ~~WIP: setup auth --list~~ WIP: setup auth npm-package Jan 26, 2023

Tobbe changed the title ~~WIP: setup auth npm-package~~ WIP: setup auth <npm-package> Jan 26, 2023

Tobbe added 3 commits January 26, 2023 05:57

Revert meaningless change in test-project

cfe254e

provider is requied

f22a720

Get rid of semver regex

5d0694d

Tobbe added 3 commits January 26, 2023 23:41

setup auth: add support for -f in addition to --force

e9d1a53

Extract yarnAddPackage

ec8c82b

Whitelist packages, and configure ignoreScripts

24c0729

jtoar reviewed Mar 15, 2023

View reviewed changes

jtoar closed this Oct 6, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP: setup auth <npm-package> #7430

WIP: setup auth <npm-package> #7430

Tobbe commented Jan 22, 2023 •

edited

replay-io bot commented Jan 22, 2023 •

edited

dac09 commented Jan 26, 2023

Tobbe commented Jan 26, 2023

Tobbe commented Jan 26, 2023

jtoar left a comment

jtoar Mar 15, 2023

jtoar Mar 15, 2023

jtoar Mar 15, 2023

jtoar Mar 15, 2023

jtoar commented Oct 6, 2023

WIP: setup auth <npm-package> #7430

WIP: setup auth <npm-package> #7430

Conversation

Tobbe commented Jan 22, 2023 • edited

replay-io bot commented Jan 22, 2023 • edited

dac09 commented Jan 26, 2023

Tobbe commented Jan 26, 2023

Tobbe commented Jan 26, 2023

jtoar left a comment

Choose a reason for hiding this comment

jtoar Mar 15, 2023

Choose a reason for hiding this comment

jtoar Mar 15, 2023

Choose a reason for hiding this comment

jtoar Mar 15, 2023

Choose a reason for hiding this comment

jtoar Mar 15, 2023

Choose a reason for hiding this comment

jtoar commented Oct 6, 2023

Tobbe commented Jan 22, 2023 •

edited

replay-io bot commented Jan 22, 2023 •

edited