[Tutorial/TypeScript] TS warning when no RBAC scheme is implemented

Reporting this non-critical finding here as advised:

Discovered in https://redwoodjs.com/docs/tutorial/chapter4/authentication#an-admin-section

The auth.ts file generated by yarn rw setup auth dbAuth expects a roles property to exist on the user object. However, implementers may choose (like in this tutorial chapter) not to implement role-based access control.

In that case, we’re getting

Property 'roles' does not exist on type '{ id: number; email: string; }'.ts(2339)

in three places in api/src/lib/auth.ts.

Maybe there is way to expand the interface InferredCurrentUser, making this an optional field?

[Tobbe]

This is expected behaviour, though I believe. We ship auth templates with the ability to handle roles, but there’s no reason you have to use it - all you have to do is remove the hasRole function if you don’t want roles in your project.

I think its a good thing that you get that TypeScript error - imagine trying to implement Roles, if we made it optional - you wouldn’t be able to spot that Roles isn’t being picked out from the DB.

I can’t decide if I agree or not here 😆

I love the help TS gives you in spotting errors like what you describe above. But I also don’t like it when generated code is throwing errors in my face 🙂 Always leaves me with questions like “Have I done something wrong?”, “Is the generator broken?”, “What do I need to do to fix this?” etc.

I need to go through the tutorial with a TS project to see this for myself to be able to give any good suggestions on how to handle this

[Philzen]

I had totally forgotten about the fact i had written this issue when i handed in #5856 today 😆 Guess i lost track of it, sorry for not following up earlier.

@Tobbe

I also don’t like it when generated code is throwing errors in my face 🙂 Always leaves me with questions like “Have I done something wrong?”, “Is the generator broken?”, “What do I need to do to fix this?” etc

That’s exactly where i’m coming from. The question “Is the RedwoodJS generator somehow broken?” should never come up in the DX, i guess that’s what everybody is working for here. Imho it must not ever generate code that violates its own ESLint rules (see #5827) or worse (like in this case) generates invalid types that will make yarn rw check-types fail in order to build trust.

@dac09

imagine trying to implement Roles, if we made it optional - you wouldn’t be able to spot that Roles isn’t being picked out from the DB.

What about adding some JSDoc here, linking to the getCurrentUser function and giving the heads-up that roles will always be undefined unless included in the selection … would that suffice?