Zenstack latest WIP

README.md

@@ -1,18 +1,6 @@
 # Redwood Tutorial App
 
-This repo represents the final state of the app created during the [Redwood Tutorial](https://redwoodjs.com/tutorial).
-It is meant to be a starting point for those working on the second half of the Tutorial, starting at the [Intermission](https://redwoodjs.com/docs/tutorial/intermission).
+This project demonstrates how to use [ZenStack](https://zenstack.dev) in a RedwoodJS project. It's extended based on the blog app used through [RedwoodJS's tutorial](https://redwoodjs.com/docs/tutorial/foreword).
 
-This repo contains much more styling than the one we built together in the tutorial, but is functionally identical.
+Please refer to [this blog post](https://zenstack.dev/blog/redwood-auth) for a general introduction.
 
-## Setup
-
-The [tutorial itself](https://redwoodjs.com/docs/tutorial/chapter1/prerequisites) contains instructions for getting this repo up and running, but here is a summary of the commands:
-
-```bash
-git clone https://github.com/redwoodjs/redwood-tutorial
-cd redwood-tutorial
-yarn install
-yarn rw prisma migrate dev
-yarn rw dev
-```

api/db/migrations/20230620053259_add_policies/migration.sql

@@ -0,0 +1,49 @@
+-- RedefineTables
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_User" (
+    "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    "name" TEXT,
+    "email" TEXT NOT NULL,
+    "hashedPassword" TEXT NOT NULL,
+    "salt" TEXT NOT NULL,
+    "resetToken" TEXT,
+    "resetTokenExpiresAt" DATETIME,
+    "roles" TEXT NOT NULL DEFAULT 'moderator',
+    "zenstack_guard" BOOLEAN NOT NULL DEFAULT true,
+    "zenstack_transaction" TEXT
+);
+INSERT INTO "new_User" ("email", "hashedPassword", "id", "name", "resetToken", "resetTokenExpiresAt", "roles", "salt") SELECT "email", "hashedPassword", "id", "name", "resetToken", "resetTokenExpiresAt", "roles", "salt" FROM "User";
+DROP TABLE "User";
+ALTER TABLE "new_User" RENAME TO "User";
+CREATE UNIQUE INDEX "User_email_key" ON "User"("email");
+CREATE INDEX "User_zenstack_transaction_idx" ON "User"("zenstack_transaction");
+CREATE TABLE "new_Comment" (
+    "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    "name" TEXT NOT NULL,
+    "body" TEXT NOT NULL,
+    "postId" INTEGER NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "zenstack_guard" BOOLEAN NOT NULL DEFAULT true,
+    "zenstack_transaction" TEXT,
+    CONSTRAINT "Comment_postId_fkey" FOREIGN KEY ("postId") REFERENCES "Post" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+INSERT INTO "new_Comment" ("body", "createdAt", "id", "name", "postId") SELECT "body", "createdAt", "id", "name", "postId" FROM "Comment";
+DROP TABLE "Comment";
+ALTER TABLE "new_Comment" RENAME TO "Comment";
+CREATE INDEX "Comment_zenstack_transaction_idx" ON "Comment"("zenstack_transaction");
+CREATE TABLE "new_Post" (
+    "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    "title" TEXT NOT NULL,
+    "body" TEXT NOT NULL,
+    "userId" INTEGER NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "zenstack_guard" BOOLEAN NOT NULL DEFAULT true,
+    "zenstack_transaction" TEXT,
+    CONSTRAINT "Post_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+INSERT INTO "new_Post" ("body", "createdAt", "id", "title", "userId") SELECT "body", "createdAt", "id", "title", "userId" FROM "Post";
+DROP TABLE "Post";
+ALTER TABLE "new_Post" RENAME TO "Post";
+CREATE INDEX "Post_zenstack_transaction_idx" ON "Post"("zenstack_transaction");
+PRAGMA foreign_key_check;
+PRAGMA foreign_keys=ON;

api/db/migrations/20230622084334_add_published/migration.sql

@@ -0,0 +1,19 @@
+-- RedefineTables
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_Post" (
+    "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    "title" TEXT NOT NULL,
+    "body" TEXT NOT NULL,
+    "userId" INTEGER NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "published" BOOLEAN NOT NULL DEFAULT true,
+    "zenstack_guard" BOOLEAN NOT NULL DEFAULT true,
+    "zenstack_transaction" TEXT,
+    CONSTRAINT "Post_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+INSERT INTO "new_Post" ("body", "createdAt", "id", "title", "userId", "zenstack_guard", "zenstack_transaction") SELECT "body", "createdAt", "id", "title", "userId", "zenstack_guard", "zenstack_transaction" FROM "Post";
+DROP TABLE "Post";
+ALTER TABLE "new_Post" RENAME TO "Post";
+CREATE INDEX "Post_zenstack_transaction_idx" ON "Post"("zenstack_transaction");
+PRAGMA foreign_key_check;
+PRAGMA foreign_keys=ON;

api/db/schema.prisma

@@ -1,48 +1,74 @@
+//////////////////////////////////////////////////////////////////////////////////////////////
+// DO NOT MODIFY THIS FILE                                                                  //
+// This file is automatically generated by ZenStack CLI and should not be manually updated. //
+//////////////////////////////////////////////////////////////////////////////////////////////
+
 datasource db {
-  provider = "sqlite"
-  url      = env("DATABASE_URL")
+    provider="sqlite"
+    url=env("DATABASE_URL")
 }
 
 generator client {
-  provider      = "prisma-client-js"
-  binaryTargets = "native"
+    provider = "prisma-client-js"
+    binaryTargets = "native"
+    previewFeatures = ["interactiveTransactions"]
 }
 
+/// @@allow('all', auth().roles == 'admin' && auth() == user)
+/// @@allow('read', published)
 model Post {
-  id        Int      @id @default(autoincrement())
-  title     String
-  body      String
-  comments  Comment[]
-  user      User     @relation(fields: [userId], references: [id])
-  userId    Int
-  createdAt DateTime @default(now())
+    id Int @id() @default(autoincrement())
+    title String
+    body String
+    comments Comment[]
+    user User @relation(fields: [userId], references: [id])
+    userId Int
+    createdAt DateTime @default(now())
+    published Boolean @default(true)
+
+    zenstack_guard Boolean @default(true)
+    zenstack_transaction String?
+
+    @@index([zenstack_transaction])
 }
 
 model Contact {
-  id        Int      @id @default(autoincrement())
-  name      String
-  email     String
-  message   String
-  createdAt DateTime @default(now())
+    id Int @id() @default(autoincrement())
+    name String
+    email String
+    message String
+    createdAt DateTime @default(now())
 }
 
 model User {
-  id                  Int @id @default(autoincrement())
-  name                String?
-  email               String @unique
-  hashedPassword      String
-  salt                String
-  resetToken          String?
-  resetTokenExpiresAt DateTime?
-  roles               String @default("moderator")
-  posts               Post[]
+    id Int @id() @default(autoincrement())
+    name String?
+    email String @unique()
+    hashedPassword String
+    salt String
+    resetToken String?
+    resetTokenExpiresAt DateTime?
+    roles String @default("moderator")
+    posts Post[]
+
+    zenstack_guard Boolean @default(true)
+    zenstack_transaction String?
+
+    @@index([zenstack_transaction])
 }
 
+/// @@allow('all', auth().roles == 'moderator')
+/// @@allow('create,read', post.published)
 model Comment {
-  id        Int      @id @default(autoincrement())
-  name      String
-  body      String
-  post      Post     @relation(fields: [postId], references: [id])
-  postId    Int
-  createdAt DateTime @default(now())
-}
+    id Int @id() @default(autoincrement())
+    name String
+    body String
+    post Post @relation(fields: [postId], references: [id])
+    postId Int
+    createdAt DateTime @default(now())
+
+    zenstack_guard Boolean @default(true)
+    zenstack_transaction String?
+
+    @@index([zenstack_transaction])
+}

api/package.json

@@ -4,6 +4,10 @@
   "private": true,
   "dependencies": {
     "@redwoodjs/api": "3.2.0",
-    "@redwoodjs/graphql-server": "3.2.0"
+    "@redwoodjs/graphql-server": "3.2.0",
+    "@zenstackhq/runtime": "^1.0.0-beta.24"
+  },
+  "devDependencies": {
+    "zenstack": "^1.0.0-beta.24"
   }
 }

api/schema.zmodel

@@ -0,0 +1,67 @@
+datasource db {
+  provider = "sqlite"
+  url      = env("DATABASE_URL")
+}
+
+plugin prisma {
+  provider = '@core/prisma'
+  output = './db/schema.prisma'
+}
+
+generator client {
+  provider      = "prisma-client-js"
+  binaryTargets = "native"
+  previewFeatures = ["interactiveTransactions"]
+}
+
+model Post {
+  id        Int      @id @default(autoincrement())
+  title     String
+  body      String
+  comments  Comment[]
+  user      User     @relation(fields: [userId], references: [id])
+  userId    Int
+  createdAt DateTime @default(now())
+  published Boolean @default(true)
+
+  // 🔐 Admin user can do everything to his own posts
+  @@allow('all', auth().roles == 'admin' && auth() == user)
+
+  // 🔐 Posts are visible to everyone if published
+  @@allow('read', published)
+}
+
+model Contact {
+  id        Int      @id @default(autoincrement())
+  name      String
+  email     String
+  message   String
+  createdAt DateTime @default(now())
+}
+
+model User {
+  id                  Int @id @default(autoincrement())
+  name                String?
+  email               String @unique
+  hashedPassword      String
+  salt                String
+  resetToken          String?
+  resetTokenExpiresAt DateTime?
+  roles               String @default("moderator")
+  posts               Post[]
+}
+
+model Comment {
+  id        Int      @id @default(autoincrement())
+  name      String
+  body      String
+  post      Post     @relation(fields: [postId], references: [id])
+  postId    Int
+  createdAt DateTime @default(now())
+
+  // 🔐 Moderator user can do everything to comments
+  @@allow('all', auth().roles == 'moderator')
+
+  // 🔐 Everyone is allowed to view and create comments for published posts
+  @@allow('create,read', post.published)
+}

api/src/graphql/adminPosts.sdl.js

@@ -18,6 +18,8 @@ export const schema = gql`
     createPost(input: CreatePostInput!): Post! @requireAuth(roles: ["admin"])
     updatePost(id: Int!, input: UpdatePostInput!): Post!
       @requireAuth(roles: ["admin"])
+    publishPost(id: Int!): Post! @requireAuth(roles: ["admin"])
+    unpublishPost(id: Int!): Post! @requireAuth(roles: ["admin"])
     deletePost(id: Int!): Post! @requireAuth(roles: ["admin"])
   }
 `

api/src/graphql/comments.sdl.js

@@ -26,6 +26,6 @@ export const schema = gql`
 
   type Mutation {
     createComment(input: CreateCommentInput!): Comment! @skipAuth
-    deleteComment(id: Int!): Comment! @requireAuth(roles: "moderator")
+    deleteComment(id: Int!): Comment! @skipAuth
   }
 `

api/src/graphql/posts.sdl.js

@@ -5,6 +5,7 @@ export const schema = gql`
     body: String!
     createdAt: DateTime!
     user: User!
+    published: Boolean!
   }
 
   type Query {

api/src/lib/db.js

@@ -2,6 +2,7 @@
 // for options.
 
 import { PrismaClient } from '@prisma/client'
+import { enhance } from '@zenstackhq/runtime'
 
 import { emitLogLevels, handlePrismaLogging } from '@redwoodjs/api/logger'
 
@@ -14,6 +15,13 @@ export const db = new PrismaClient({
   log: emitLogLevels(['info', 'warn', 'error']),
 })
 
+/*
+ * Returns ZenStack wrapped Prisma Client with access policies enabled.
+ */
+export function authDb() {
+  return enhance(db, { user: context.currentUser })
+}
+
 handlePrismaLogging({
   db,
   logger,

api/src/services/adminPosts/adminPosts.js

@@ -35,6 +35,28 @@ export const updatePost = async ({ id, input }) => {
   })
 }
 
+export const publishPost = async ({ id }) => {
+  await validateOwnership({ id })
+
+  return db.post.update({
+    where: { id },
+    data: {
+      published: true,
+    },
+  })
+}
+
+export const unpublishPost = async ({ id }) => {
+  await validateOwnership({ id })
+
+  return db.post.update({
+    where: { id },
+    data: {
+      published: false,
+    },
+  })
+}
+
 export const deletePost = async ({ id }) => {
   await validateOwnership({ id })
 

api/src/services/comments/comments.js

@@ -1,31 +1,29 @@
-import { requireAuth } from 'src/lib/auth'
-import { db } from 'src/lib/db'
+import { authDb } from 'src/lib/db'
 
 export const comments = ({ postId }) => {
-  return db.comment.findMany({ where: { postId } })
+  return authDb().comment.findMany({ where: { postId } })
 }
 
 export const comment = ({ id }) => {
-  return db.comment.findUnique({
+  return authDb().comment.findUnique({
     where: { id },
   })
 }
 
 export const createComment = ({ input }) => {
-  return db.comment.create({
+  return authDb().comment.create({
     data: input,
   })
 }
 
 export const deleteComment = ({ id }) => {
-  requireAuth({ roles: 'moderator' })
-  return db.comment.delete({
+  return authDb().comment.delete({
     where: { id },
   })
 }
 
 export const Comment = {
   post: (_obj, { root }) => {
-    return db.comment.findUnique({ where: { id: root?.id } }).post()
+    return authDb().post.findUnique({ where: { id: root?.postId } })
   },
 }