Gate wasp-auth-only codegen behind the provider and expose the active provider identity

Author: FranjoMindek

examples/auth-providers/clerk/main.wasp.ts

@@ -27,6 +27,20 @@ export default app({
       id: "clerk",
       server: clerkAuthProvider,
       capabilities: ["session-revocation"],
+      // Rendered into the generated env validation: a missing var fails at
+      // boot with this explanation, not at the first authenticated request.
+      env: {
+        server: [
+          { name: "CLERK_SECRET_KEY", doc: "Clerk dashboard → API keys" },
+          { name: "CLERK_PUBLISHABLE_KEY", doc: "Clerk dashboard → API keys" },
+          {
+            name: "CLERK_JWT_KEY",
+            optional: true,
+            doc: "enables networkless JWT verification",
+          },
+        ],
+        client: [],
+      },
     }),
   },
 

waspc/data/Generator/templates/sdk/wasp/auth/provider.ts

@@ -0,0 +1,23 @@
+{{={= =}=}}
+// PUBLIC API
+/**
+ * The auth provider this app runs on, as a literal the type system narrows.
+ *
+ * Guard provider-specific code with it and TypeScript will tell you at compile
+ * time when the app switches providers:
+ *
+ * ```ts
+ * import { authProviderId } from 'wasp/auth/provider'
+ * ```
+ */
+export const authProviderId = "{= providerId =}" as const;
+
+// PUBLIC API
+export type AuthProviderId = typeof authProviderId;
+
+// PUBLIC API
+/**
+ * The capabilities the provider declared. An open set: adapters may declare
+ * capabilities newer than this version of Wasp knows about.
+ */
+export const authCapabilities = {=& capabilities =} as const;

waspc/data/Generator/templates/sdk/wasp/client/auth/index.ts

@@ -1,5 +1,7 @@
 {{={= =}=}}
+{=^ isExternalAuthProviderUsed =}
 export * from './ui'
+{=/ isExternalAuthProviderUsed =}
 {=# isEmailAuthEnabled =}
 export * from './email'
 {=/ isEmailAuthEnabled =}

waspc/data/Generator/templates/sdk/wasp/client/env/schema.ts

@@ -25,13 +25,30 @@ const serverUrlSchema =
     })
   )
 
+{=# isExternalAuthProviderUsed =}
+{=! Env vars the external auth provider's manifest declared for the client. =}
+const externalAuthProviderEnvSchema = z.object({
+  {=# externalAuthProviderClientEnvVars =}
+  "{= name =}": z.string({
+    error: {=& errorJson =},
+  }){=# isOptional =}.optional(){=/ isOptional =},
+  {=/ externalAuthProviderClientEnvVars =}
+});
+
+{=/ isExternalAuthProviderUsed =}
 const waspDevClientEnvSchema = z.object({
   "{= serverUrlEnvVarName =}": serverUrlSchema
     .default("{= defaultServerUrl =}"),
+{=# isExternalAuthProviderUsed =}
+  ...externalAuthProviderEnvSchema.shape,
+{=/ isExternalAuthProviderUsed =}
 });
 
 const waspProdClientEnvSchema = z.object({
   "{= serverUrlEnvVarName =}": serverUrlSchema,
+{=# isExternalAuthProviderUsed =}
+  ...externalAuthProviderEnvSchema.shape,
+{=/ isExternalAuthProviderUsed =}
 });
 
 const waspClientEnvSchema = import.meta.env.MODE === "production"

waspc/data/Generator/templates/sdk/wasp/package.json

@@ -63,6 +63,10 @@
       ===============================================================
     =}
     "./auth": "./dist/auth/index.js",
+    {=# isAuthEnabled =}
+    {=! Users: which auth provider the app runs on, as narrowable literals. =}
+    "./auth/provider": "./dist/auth/provider.js",
+    {=/ isAuthEnabled =}
     {=! FIXME: Documented only in example apps, not in docs. Also re-exported through `wasp/server/auth`.=}
     {=! FIXME: Candidate for removal? =}
     {=! Users: validators in custom auth actions. =}
@@ -116,10 +120,14 @@
       Internal server runtime API. Undocumented.
       ===============================================================
     =}
+    {=! Wasp-auth-only modules. Not generated under an external auth provider,
+        so their exports are dropped too and importing them is an error. =}
+    {=^ isCustomAuthProviderUsed =}
     "./server/auth/email": "./dist/server/auth/email/index.js",
     "./server/auth/email/utils": "./dist/server/auth/email/utils.js",
     "./server/auth/jwt": "./dist/server/auth/jwt.js",
     "./server/auth/password": "./dist/server/auth/password.js",
+    {=/ isCustomAuthProviderUsed =}
     {=! Server: the contract a custom auth provider implements. Adapters live in
         user code, so they need to import this as a normal module. =}
     "./server/auth/provider/types": "./dist/server/auth/provider/types.js",

waspc/data/Generator/templates/sdk/wasp/server/auth/index.ts

@@ -3,6 +3,14 @@ export {
   defineUserSignupFields,
 } from '../../auth/providers/types.js'
 
+{=# isCustomAuthProviderUsed =}
+{=! Under an external provider, `wasp/server/auth` keeps only what is
+    provider-independent: typing `userSignupFields` and the error helper the
+    generated code itself uses. Everything password- and hook-shaped belongs
+    to Wasp's own auth and is not generated at all. =}
+export { createInvalidCredentialsError } from './utils.js'
+{=/ isCustomAuthProviderUsed =}
+{=^ isCustomAuthProviderUsed =}
 export {
   createProviderId,
   sanitizeAndSerializeProviderData,
@@ -35,6 +43,7 @@ export type {
   InternalAuthHookParams,
   OAuthData,
 } from './hooks.js'
+{=/ isCustomAuthProviderUsed =}
 
 {=# isExternalAuthEnabled =}
 export * from './oauth/index.js'

waspc/data/Generator/templates/sdk/wasp/server/auth/provider/index.ts

@@ -1,5 +1,5 @@
 {{={= =}=}}
-import { type AuthProvider } from './types.js'
+import { {=# isCustomAuthProviderUsed =}canIssueSessions as canProviderIssueSessions, {=/ isCustomAuthProviderUsed =}type AuthProvider } from './types.js'
 {=# isCustomAuthProviderUsed =}
 {=& authProvider.importStatement =}
 {=/ isCustomAuthProviderUsed =}
@@ -25,6 +25,46 @@ export {
  */
 export const authProvider: AuthProvider =
   {=# isCustomAuthProviderUsed =}{= authProvider.importIdentifier =}{=/ isCustomAuthProviderUsed =}{=^ isCustomAuthProviderUsed =}waspAuthProvider{=/ isCustomAuthProviderUsed =}
+{=# isCustomAuthProviderUsed =}
+
+/**
+ * The manifest in `main.wasp.ts` made compile-time claims about this provider
+ * (its id, its capabilities), and code was generated from them. Checking the
+ * claims against the adapter object at boot turns a wrong manifest into a
+ * loud startup failure instead of a subtly broken app.
+ */
+function assertProviderMatchesManifest(): void {
+  const manifestProviderId = "{= manifestProviderId =}";
+  const manifestCapabilities: string[] = {=& manifestCapabilities =};
+
+  if (authProvider.id !== manifestProviderId) {
+    throw new Error(
+      `The auth provider manifest declares id '${manifestProviderId}', but the adapter's id is '${authProvider.id}'. ` +
+        `Identities are recorded under the provider id, so the two must match.`,
+    );
+  }
+
+  if (
+    manifestCapabilities.includes('issue-sessions') &&
+    !canProviderIssueSessions(authProvider)
+  ) {
+    throw new Error(
+      `The auth provider manifest for '${manifestProviderId}' declares the 'issue-sessions' capability, but the adapter does not implement issueSession/revokeAllSessions.`,
+    );
+  }
+
+  if (
+    manifestCapabilities.includes('session-revocation') &&
+    typeof authProvider.revokeSession !== 'function'
+  ) {
+    throw new Error(
+      `The auth provider manifest for '${manifestProviderId}' declares the 'session-revocation' capability, but the adapter does not implement revokeSession.`,
+    );
+  }
+}
+
+assertProviderMatchesManifest()
+{=/ isCustomAuthProviderUsed =}
 
 // PRIVATE API
 /**

waspc/data/Generator/templates/sdk/wasp/server/auth/provider/types.ts

@@ -1,4 +1,5 @@
 import { type AuthProvider } from '@wasp.sh/auth-contract'
+import { type UserSignupFields } from '../../../auth/providers/types.js'
 import { type FromRegister } from '../../../types/register.js'
 
 // PRIVATE API
@@ -25,3 +26,15 @@ export {
  * contract at build time rather than failing somewhere inside the session layer.
  */
 export type RegisteredAuthProvider = FromRegister<'authProvider', AuthProvider>
+
+// PRIVATE API
+/**
+ * The `userSignupFields` the developer registered on the external provider's
+ * manifest, if any. Feeds just-in-time provisioning: when Wasp first sees a
+ * subject, these fields populate the new row of the app's own user entity from
+ * the claims the provider verified.
+ */
+export type RegisteredAuthProviderUserSignupFields = FromRegister<
+  'authProviderUserSignupFields',
+  UserSignupFields
+>

waspc/data/Generator/templates/sdk/wasp/server/auth/session.ts

@@ -8,6 +8,12 @@ import { type VerifiedSession } from "./provider/types.js";
 
 import { config, prisma } from '../index.js';
 import { createAuthUserData } from "../../auth/user.js";
+{=# isCustomAuthProviderUsed =}
+import { validateAndGetUserFields } from './utils.js';
+{=# externalUserSignupFields.isDefined =}
+{=& externalUserSignupFields.importStatement =}
+{=/ externalUserSignupFields.isDefined =}
+{=/ isCustomAuthProviderUsed =}
 
 /**
  * Wasp's session layer.
@@ -152,8 +158,19 @@ async function resolveExternalSubject(
   }
 
   try {
+    // The app's `userSignupFields` compute the new user's own fields from the
+    // claims the provider verified -- the only way a user entity with required
+    // columns can be provisioned at all.
+    const userFields = await validateAndGetUserFields(
+      { ...(claims ?? {}) },
+      {=# externalUserSignupFields.isDefined =}{= externalUserSignupFields.importIdentifier =}{=/ externalUserSignupFields.isDefined =}{=^ externalUserSignupFields.isDefined =}undefined{=/ externalUserSignupFields.isDefined =},
+    );
+
     const created = await prisma.{= userEntityLower =}.create({
       data: {
+        // Using `any` to defer validation of required-but-unset fields to
+        // Prisma, which reports them precisely.
+        ...(userFields as any),
         {= authFieldOnUserEntityName =}: {
           create: {
             {= identitiesFieldOnAuthEntityName =}: {

waspc/data/Generator/templates/sdk/wasp/server/auth/utils.ts

@@ -1,5 +1,7 @@
 {{={= =}=}}
+{=^ isCustomAuthProviderUsed =}
 import { hashPassword } from './password.js'
+{=/ isCustomAuthProviderUsed =}
 import { prisma, HttpError } from '../index.js'
 import { sleep } from '../utils.js'
 import {
@@ -57,6 +59,7 @@ export async function findAuthIdentity(providerId: ProviderId): Promise<{= authI
   });
 }
 
+{=^ isCustomAuthProviderUsed =}
 // PUBLIC API
 /**
  * Updates the provider data for the given auth identity.
@@ -86,6 +89,7 @@ export async function updateAuthIdentityProviderData<PN extends ProviderName>(
     data: { providerData: serializedProviderData },
   });
 }
+{=/ isCustomAuthProviderUsed =}
 
 // PRIVATE API
 export type FindAuthWithUserResult = {= authEntityUpper =} & {
@@ -237,6 +241,7 @@ export async function validateAndGetUserFields(
   return result;
 }
 
+{=^ isCustomAuthProviderUsed =}
 // PUBLIC API
 export async function sanitizeAndSerializeProviderData<PN extends ProviderName>(
   providerData: PossibleProviderData[PN],
@@ -262,6 +267,7 @@ async function ensurePasswordIsHashed<PN extends ProviderName>(
 
   return data;
 }
+{=/ isCustomAuthProviderUsed =}
 
 // PRIVATE API
 export function createInvalidCredentialsError(message?: string): HttpError {