Skip to content

feat(create-cedar-app): enable TypeScript strict mode in new apps - #2993

Open
Tobbe wants to merge 13 commits into
mainfrom
tobbe-ts-strict-default
Open

Tobbe wants to merge 13 commits into
mainfrom
tobbe-ts-strict-default

Conversation

@Tobbe

@Tobbe Tobbe commented Oct 11, 2026 •

Copy link
Copy Markdown
Member

Summary

New TypeScript apps created with create-cedar-app have TypeScript's strict mode turned on, and the code that yarn cedar generate ... and yarn cedar setup ... write type-checks under strict mode. This is one of the planned Cedar v8 items.

Existing apps aren't changed: their tsconfig files keep their settings, and there's no upgrade script. The docs and the v8 release notes explain how to turn strict mode on in an existing app. Code generated into an app without strict mode works as before.

Related PRs

This PR was split up to stay under CodeRabbit's 100-file limit. The other parts are merged:

Still to come: #2997 (draft), the hand-updated test-project-live/-pnpm fixture copies. Merge it after this PR.

What changed

Templates (create-cedar-app)

  • "strict": true in web/tsconfig.json, api/tsconfig.json and scripts/tsconfig.json. None of the existing options overlapped with strict (no strict*/noImplicitAny flags), so nothing else needed tidying.
  • api/src/lib/auth.ts: hasRole and requireAuth get a typed roles argument.
  • The JS template is regenerated with ts-to-js, so its jsconfig.json files also set strict. That only takes effect if an app turns on checkJs.
  • create-cedar-rsc-app has no templates of its own; it downloads __fixtures__/test-project-rsc-kitchen-sink from GitHub. That fixture is left as is.
  • create-cedar-app's tests only list template files, so no snapshot changes.

Generators (yarn cedar generate)

  • service (--crud, also via sdl/scaffold):
    • update<Model> turns null into undefined for fields that are required in Prisma (GraphQL can't express "optional, but not null"). Nullable Json fields map null to Prisma.DbNull on create and update, since Prisma rejects null for Json fields.
    • Relation resolvers use findUniqueOrThrow({ where: { id: root.id } }) for required and list relations, so they aren't nullable. Optional to-one relations keep findUnique, so they return null when the parent is gone (for example when selected from delete<Model>).
    • Tests pass BigInt inputs as numbers (the GraphQL input type), and create/update test inputs skip createdAt/updatedAt (not in the SDL inputs; this was a type error even without strict mode). String @id fields without a default get unique scenario values.
  • scaffold:
    • The form's onSave takes a Create<Model>Input, and error is optional.
    • The edit cell passes <model>.<idName> itself and uses the Update<Model>Mutation type. This also fixes the hard-coded id variable for custom id names.
    • Nullable fields' default values are ?? undefined, and the empty enum radio option is mapped with !value.
    • The truncate and checkboxInputTag formatters accept nullish values.
  • dbAuth --webauthn: typed login page (useRef<HTMLInputElement>, form data, catch narrowing, null-safe webAuthn client).
  • realtime: typed subscription, live query and example templates. The generated subscription service imports the channel type from src/subscriptions/<name>/<name>.js, the file the generator writes.
  • sdl: Prisma scalar and enum lists get non-nullable items (tags: [String!]!), so generated create/update inputs match Prisma's input types.
  • og-image: typed output props.
  • script/package: the generated tsconfig.json sets strict.
  • page, layout, component, cell, function, directive, job, dataMigration and secret needed no changes.

Test-project fixture

  • tasks/test-project:
    • The db-import test templates declare the __cedarjs_db_imported__ global.
    • The ContactUs page form is typed, and the Profile page handles a null currentUser.
    • createContact stays Contact!, full-name is read null-safely, and the describe-scenario test is null-safe.
  • __fixtures__/test-project is the output of yarn rebuild-test-project-fixture.
  • __fixtures__/test-project-live and -pnpm get the same changes in chore(fixtures): sync test-project-live and -pnpm with strict test-project #2997.

Docs and release notes

  • docs/docs/typescript/strict-mode.md:
    • New apps have strict mode on.
    • How to turn it on in an existing app.
    • The services, relation resolvers and getCurrentUser sections describe what the generators produce now.
  • docs/docs/typescript/introduction.md says new projects have strict mode on.
  • New "TypeScript strict mode in new projects" section in .changesets/release_notes_v8.md. The generated-type changes are described in feat(types)!: more precise generated and exported types for strict apps #2995's "More precise generated types" section.

Verification

  • yarn build, then yarn rebuild-test-project-fixture (success message, no failure text).
  • yarn build:test-project <tmp> --link from the rebuilt fixture, then in that project:
    • yarn cedar type-check (strict): 0 errors
    • yarn cedar lint: passes
    • yarn cedar test api: 24 tests pass
    • yarn cedar test web: 45 tests pass
  • Fresh app from local create-cedar-app plus cfw project:tarsync, then 43 generator/setup commands, all of which succeeded:
    • scaffold for 5 models: a rich Widget model with every scalar type, nullable variants, Json/Json?, enums, BigInt, Decimal and @updatedAt; required and optional relations; and a String @id model
    • page, layout, component, cells (single, --list, --query)
    • sdl --crud, service --crud --tests
    • function, directives (validator and transformer), script, secret, package, setup jobs and job, data-migration
    • setup auth dbAuth --webauthn --createUserModel and g dbAuth --webauthn
    • mailer, server-file, realtime --includeExamples with a subscription and a live query, uploads (fs, db, s3), cache (redis), graphql fragments and trusted-documents, sentry, og-image
    • Results:
      • yarn cedar type-check (strict): 1 error, pre-existing (see known gaps)
      • yarn cedar test api: 40 tests pass
      • yarn cedar test web: 34 tests pass
  • Separate fresh apps:
    • setup auth auth0, supabase, clerk and firebase, each on a clean copy: yarn cedar type-check 0 errors.
    • dbAuth with a hand-written User model, plus setup tenancy and setup i18n: no strict-specific errors remain.
  • Framework tests:
    • yarn vitest run in packages/cli: 1717 tests pass. The snapshots were updated with vitest -u and each diff was reviewed.
    • packages/create-cedar-app: 6 tests pass
    • packages/internal: 308 tests pass
    • packages/router: 244 tests pass, plus test:types (21)
    • packages/uploads: 124 tests pass
    • packages/auth-providers/dbAuth/web and the auth provider setup packages pass, and so do the packages/api cache tests
  • ESLint and Prettier pass on all changed files.

Known gaps

These all fail without strict mode too; strict mode doesn't change them:

  • api/src/directives/requireAuth/requireAuth.test.ts mocks currentUser: { id: 1 }. That doesn't match apps whose getCurrentUser returns a string id (setup auth dbAuth --createUserModel) or always returns roles (netlify).
  • setup i18n writes web/.storybook/preview.tsx, which needs Storybook (@storybook/csf) installed to type-check.
  • The tenancy test templates create users with fullName, which the --createUserModel User model doesn't have.
  • setup supertokens web output (PreBuiltUI in Routes.tsx) wasn't type-checked on a clean app.
  • Some setup commands (sentry, uploads, server-file, graphql fragments, the webauthn login page's autoFocus) leave import-order or prettier lint errors that yarn cedar lint --fix fixes.
  • setup auth was verified for auth0, supabase, clerk and firebase on clean apps. netlify, azureActiveDirectory, supertokens and custom were only run on top of each other in one app, so those results aren't conclusive.
  • The experimental streaming-SSR/RSC tsconfig templates and the RSC fixtures aren't changed.

New TypeScript apps set `"strict": true` in web, api and scripts
tsconfig.json, and the code generators and setup commands write is typed
for strict mode: scaffolds, cells, services and their tests, dbAuth (incl.
WebAuthn), realtime, uploads, cache, sentry, tenancy, og-image and the
third-party auth providers' api/src/lib/auth.ts.

Generated types the generated code relies on are more precise:
QueryResolvers/MutationResolvers fields are required, api-side JSON inputs
use Prisma's input JSON types, CurrentUser excludes null, and <Set wrap>
infers its forwarded props from the wrapper components.

Existing apps keep their tsconfig files. Docs and the v8 release notes
describe how to turn strict mode on.
@netlify

netlify Bot commented Oct 11, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for cedarjs ready!

Name Link
🔨 Latest commit 1cb1dd8
🔍 Latest deploy log https://app.netlify.com/projects/cedarjs/deploys/6acc0ba54c742b0008d4f199
😎 Deploy Preview https://deploy-preview-2993--cedarjs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@coderabbitai

coderabbitai Bot commented Oct 11, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: c3cad203-009e-43d8-951e-a0c31bdafe5d

📥 Commits

Reviewing files that changed from the base of the PR and between 57052f4 and 1cb1dd8.


📒 Files selected for processing (3)
  • packages/cli/src/commands/generate/service/__tests__/fixtures/schema.prisma
  • packages/cli/src/commands/generate/service/__tests__/service.test.ts
  • packages/cli/src/commands/generate/service/serviceHandler.ts

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 08b45f4a-93f6-4f2b-95eb-58b11cec0728



📥 Commits

Reviewing files that changed from the base of the PR and between 75a8797 and 57052f4.




⛔ Files ignored due to path filters (7)
  • packages/cli/src/commands/generate/dbAuth/__tests__/__snapshots__/dbAuth.test.ts.snap is excluded by !**/*.snap
  • packages/cli/src/commands/generate/package/__tests__/__snapshots__/package.test.ts.snap is excluded by !**/*.snap
  • packages/cli/src/commands/generate/scaffold/__tests__/__snapshots__/scaffold.test.ts.snap is excluded by !**/*.snap
  • packages/cli/src/commands/generate/scaffold/__tests__/__snapshots__/scaffoldNoNest.test.ts.snap is excluded by !**/*.snap
  • packages/cli/src/commands/generate/sdl/__tests__/__snapshots__/sdl.test.ts.snap is excluded by !**/*.snap
  • packages/cli/src/commands/generate/sdl/__tests__/__snapshots__/sdlStubs.test.ts.snap is excluded by !**/*.snap
  • packages/cli/src/commands/generate/service/__tests__/__snapshots__/service.test.ts.snap is excluded by !**/*.snap



📒 Files selected for processing (1)
  • .changesets/release_notes_v8.md



Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.





📝 Summary

Summary by CodeRabbit

  • New Features

    • New projects now enable TypeScript strict mode across the web, API, and scripts. Guidance explains how existing projects can opt in and what to review when upgrading.
    • Generated GraphQL types now distinguish non-null scalar and enum list items from nullable relation list items.
  • Bug Fixes

    • Generated forms and services handle nullable inputs more safely, including preserving required fields when updates provide null.
    • Generated pages and authentication flows handle missing user or profile data more gracefully.
📝 Summary
📝 Summary

Walkthrough

New project templates enable TypeScript strict mode. Generator templates and test-project examples update their types and handling of nullable inputs and relations. TypeScript guidance and release notes describe the new defaults and migration steps.

Changes

Strict-mode defaults and guidance

Layer / File(s) Summary
Strict-mode defaults and guidance
.changesets/release_notes_v8.md, docs/docs/typescript/*, packages/create-cedar-app/templates/{js,ts}/..., packages/cli/src/commands/generate/{package,script}/templates/tsconfig.json.template, __fixtures__/test-project/.../tsconfig.json
New project templates and fixture configurations enable strict mode. The documentation and release notes describe project defaults, existing-project guidance, and changes to strict-mode generated types.
SDL input and list nullability
packages/cli/src/commands/generate/helpers.ts, packages/cli/src/commands/generate/sdl/*
Shared input-field helpers support SDL generation. Scalar and enum list items are generated as non-null, while object-list items remain nullable; tests cover these cases.
Generated service input and relation handling
packages/cli/src/commands/generate/service/*
Service generation derives metadata for required update fields, nullable JSON fields, and nullable relations. Generated mutations map nullable inputs as needed, and relation resolvers choose lookups based on relation nullability. Tests cover relation lookup generation and BigInt inputs.
Scaffold and feature templates
packages/cli/src/commands/generate/scaffold/*, packages/cli/src/commands/generate/dbAuth/templates/login.webAuthn.tsx.template, packages/cli/src/commands/generate/realtime/templates/*, packages/cli/src/commands/generate/ogImage/templates/ogImage.og.tsx.template
Scaffold forms and edit cells use revised input and ID contracts. Formatter templates accept nullish values. WebAuthn, realtime, and Open Graph templates receive explicit types and null-safe checks.
Strict-mode test-project updates
__fixtures__/test-project/{api,web}/src/..., tasks/test-project/{base-tasks.mts,codemods/*,templates/*}
Test-project code and generated-code templates add explicit types and null handling across API and web examples. The examples also update form contracts, resolver lookups, page states, and story IDs.




Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 57052

The supplied review evidence identifies no confirmed behavior issue that requires holding the merge.

Pre-merge checks | Passed 4 | Failed 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 37.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 44 files. (1 skipped: … Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Title check Passed The title clearly and concisely identifies the primary change: enabling TypeScript strict mode in new apps created with create-cedar-app.
Description check Passed The description directly explains the strict-mode changes, affected templates and generators, documentation updates, compatibility for existing apps, verification results, and known gaps.


Full details: Docstring Coverage

Explanation

Docstring coverage is 37.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 44 files. (1 skipped: 1 unsupported.)




  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added this to the next-release milestone Oct 11, 2026
@nx-cloud

nx-cloud Bot commented Oct 11, 2026 •

Copy link
Copy Markdown

View your CI Pipeline Execution ↗ for commit 1cb1dd8

Command Status Duration Result
nx run-many -t build:pack --exclude create-ceda... ✅ Succeeded 3s View ↗
nx run-many -t build --output-style=stream ✅ Succeeded 4s View ↗
nx run-many -t test --maxWorkers=4 ✅ Succeeded 1m View ↗
nx run-many -t test:types ✅ Succeeded 13s View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗


☁️ Nx Cloud last updated this comment at 2026-10-11 22:41:27 UTC

@greptile-apps

greptile-apps Bot commented Oct 11, 2026 •

Copy link
Copy Markdown
Contributor

RetriggerConfidence Score: 5/5

[Medium impact] The PR appears safe to merge; the required-timestamp finding is fixed and no new blocking issue remains.

Summary

This PR turns on TypeScript strict mode in new apps and updates generated code to work with it.

  • New TypeScript apps start with strict checks turned on.
  • Generated services and SDL now match Prisma’s types for writes, relations, and lists.
  • Generated scaffold forms and edit cells use types that fit strict mode.
  • Other generated templates now include types and settings for strict mode.

Reviews (7) · Last reviewed commit: "chore(cli): skip the generated create te..." · Reviewed by Greptile

Comment thread packages/cli/src/commands/generate/helpers.ts
Comment thread packages/cli/src/commands/generate/service/templates/service.ts.template Outdated
Comment thread packages/router/src/__typetests__/setTypes.test.tsx Outdated
Tobbe added 3 commits October 11, 2026 02:55
- Regenerate the JS create-cedar-app template and inline the roles type in
  the TS auth template
- Spread story args before the fixed id in the test-project page stories
- Generate non-nullable items for Prisma scalar and enum lists in SDLs
- Keep findUnique for optional to-one relation resolvers
Comment thread packages/create-cedar-app/templates/ts/api/tsconfig.json
@Tobbe

Tobbe commented Oct 11, 2026

Copy link
Copy Markdown
Member Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Oct 11, 2026 •

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Tobbe added 2 commits October 12, 2026 00:03
# Conflicts:
#	.changesets/release_notes_v8.md
#	docs/docs/typescript/generated-types.md
#	packages/internal/src/__tests__/typeDefinitions.test.ts
#	packages/internal/src/generate/templates/web-test-globals.d.ts.template
#	packages/router/src/Set.tsx
Comment thread packages/cli/src/commands/generate/service/serviceHandler.ts

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant