@absolutejs/auth 0.85.0 → 0.86.1

package/dist/organizations/config.d.ts

@@ -15,6 +15,8 @@ export type OrganizationInvitationMessage = {
 };
 export type OrganizationsConfig<UserType> = {
     getUserId: (user: UserType) => string;
+    /** Return only an independently verified email. Missing evidence denies acceptance. */
+    getVerifiedEmail?: (user: UserType) => string | undefined | Promise<string | undefined>;
     organizationStore: OrganizationStore;
     canCreateOrganization?: (user: UserType) => boolean | Promise<boolean>;
     canManageMembers?: (context: {

package/dist/organizations/operations.d.ts

@@ -1,10 +1,12 @@
 import type { OrganizationId } from '../tenancy';
-import type { Organization, OrganizationInvitation, OrganizationMembership, OrganizationStore } from './types';
-export declare const acceptInvitation: ({ organizationStore, token, userId }: {
+import type { Organization, OrganizationInvitation, OrganizationStore } from './types';
+export declare const acceptInvitation: ({ organizationStore, token, userId, verifiedEmail }: {
     organizationStore: OrganizationStore;
     token: string;
     userId: string;
-}) => Promise<OrganizationMembership | undefined>;
+    /** Provider-verified email, never an unverified profile field or request body. */
+    verifiedEmail?: string;
+}) => Promise<import("./types").OrganizationMembership | undefined>;
 export declare const autoAssignOrgsByEmail: ({ email, getOrgsForDomain, organizationStore, roles, userId }: {
     email: string;
     getOrgsForDomain: (domain: string) => Promise<OrganizationId[]> | OrganizationId[];
@@ -34,6 +36,6 @@ export declare const listUserOrganizations: ({ organizationStore, userId }: {
     organizationStore: OrganizationStore;
     userId: string;
 }) => Promise<{
-    membership: OrganizationMembership;
+    membership: import("./types").OrganizationMembership;
     organization: Organization | undefined;
 }[]>;

package/dist/organizations/routes.d.ts

@@ -1,6 +1,6 @@
 import type { SessionRecord } from '../types';
 import { type OrganizationsRouteProps } from './config';
-export declare const organizationRoutes: <UserType>({ authSessionStore, canCreateOrganization, canManageMembers, emit, getUserId, invitationDurationMs, onMembershipAdded, onMembershipRemoved, onOrganizationCreated, onSendInvitation, organizationsRoute, organizationStore, ownerRoles }: OrganizationsRouteProps<UserType>) => import("elysia/types").AddRoute<"", "local", {
+export declare const organizationRoutes: <UserType>({ authSessionStore, canCreateOrganization, canManageMembers, emit, getUserId, getVerifiedEmail, invitationDurationMs, onMembershipAdded, onMembershipRemoved, onOrganizationCreated, onSendInvitation, organizationsRoute, organizationStore, ownerRoles }: OrganizationsRouteProps<UserType>) => import("elysia/types").AddRoute<"", "local", {
     decorator: {};
     store: {
         session: SessionRecord<UserType>;
@@ -100,6 +100,7 @@ export declare const organizationRoutes: <UserType>({ authSessionStore, canCreat
                             property?: string;
                             expected?: string;
                         };
+                        502: "Invitation delivery failed; create a new invitation to retry";
                     };
                     error: never;
                 };

package/dist/organizations/types.d.ts

@@ -29,6 +29,14 @@ export type OrganizationInvitation = {
     tokenHash: string;
 };
 export type OrganizationStore = {
+    /** Atomically consume a live invitation and add membership. Custom stores must
+     * implement this capability; acceptance fails closed without it. */
+    acceptInvitation?: (input: {
+        tokenHash: string;
+        userId: string;
+        verifiedEmail: string;
+        now: number;
+    }) => Promise<OrganizationMembership | undefined>;
     deleteOrganization: (organizationId: OrganizationId) => Promise<void>;
     getInvitation: (invitationId: string) => Promise<OrganizationInvitation | undefined>;
     getInvitationByTokenHash: (tokenHash: string) => Promise<OrganizationInvitation | undefined>;

package/dist/server.js

@@ -11239,29 +11239,17 @@ init_crypto();
 var acceptInvitation = async ({
   organizationStore,
   token,
-  userId
+  userId,
+  verifiedEmail
 }) => {
-  const invitation = await organizationStore.getInvitationByTokenHash(await hashToken(token));
-  if (!invitation || invitation.state !== "pending")
-    return;
-  if (invitation.expiresAt < Date.now())
+  if (!verifiedEmail?.trim() || !organizationStore.acceptInvitation)
     return;
-  const now = Date.now();
-  await organizationStore.saveInvitation({
-    ...invitation,
-    acceptedAt: now,
-    state: "accepted"
+  return organizationStore.acceptInvitation({
+    now: Date.now(),
+    tokenHash: await hashToken(token),
+    userId,
+    verifiedEmail: verifiedEmail.trim().toLowerCase()
   });
-  const membership = {
-    createdAt: now,
-    organizationId: invitation.organizationId,
-    roles: invitation.roles,
-    status: "active",
-    updatedAt: now,
-    userId
-  };
-  await organizationStore.saveMembership(membership);
-  return membership;
 };
 var createOrganization = async ({
   metadata,
@@ -11332,6 +11320,7 @@ var organizationRoutes = ({
   canManageMembers,
   emit,
   getUserId,
+  getVerifiedEmail,
   invitationDurationMs,
   onMembershipAdded,
   onMembershipRemoved,
@@ -11438,13 +11427,21 @@ var organizationRoutes = ({
       organizationStore,
       roles: roles ?? []
     });
-    await onSendInvitation?.({
-      email: invitation.email,
-      expiresAt: invitation.expiresAt,
-      inviterUserId: invitation.inviterUserId,
-      organizationId,
-      token
-    });
+    try {
+      await onSendInvitation?.({
+        email: invitation.email,
+        expiresAt: invitation.expiresAt,
+        inviterUserId: invitation.inviterUserId,
+        organizationId,
+        token
+      });
+    } catch {
+      await organizationStore.saveInvitation({
+        ...invitation,
+        state: "revoked"
+      });
+      return status("Bad Gateway", "Invitation delivery failed; create a new invitation to retry");
+    }
     await emit?.({
       at: Date.now(),
       metadata: { email: invitation.email },
@@ -11520,7 +11517,8 @@ var organizationRoutes = ({
     const membership = await acceptInvitation({
       organizationStore,
       token,
-      userId: getUserId(user)
+      userId: getUserId(user),
+      verifiedEmail: await getVerifiedEmail?.(user)
     });
     if (!membership) {
       return status("Bad Request", "Invalid or expired invitation");
@@ -11551,7 +11549,7 @@ var organizationRoutes = ({
       return status("Unauthorized", "Authentication required");
     }
     const membership = await organizationStore.getMembership(organizationId, getUserId(user));
-    if (membership?.status !== "active") {
+    if (membership?.status !== "active" && !await mayManage(user, organizationId)) {
       return status("Forbidden", "Not a member");
     }
     const members = await organizationStore.listMembershipsByOrganization(organizationId);
@@ -40417,6 +40415,27 @@ var toInvitation = (row) => ({
 });
 var createNeonOrganizationStore = (databaseUrl) => createPostgresOrganizationStore(createNeonDatabase(databaseUrl));
 var createPostgresOrganizationStore = (db) => ({
+  acceptInvitation: async ({ now, tokenHash, userId, verifiedEmail }) => {
+    const claimed = db.$with("claimed").as(db.update(organizationInvitationsTable).set({ accepted_at_ms: now, state: "accepted" }).where(and(eq(organizationInvitationsTable.token_hash, tokenHash), eq(organizationInvitationsTable.state, "pending"), gt(organizationInvitationsTable.expires_at_ms, now), sql`lower(trim(${organizationInvitationsTable.email})) = ${verifiedEmail}`, exists(db.select().from(organizationsTable).where(eq(organizationsTable.organization_id, organizationInvitationsTable.organization_id))), notExists(db.select().from(organizationMembershipsTable).where(and(eq(organizationMembershipsTable.organization_id, organizationInvitationsTable.organization_id), eq(organizationMembershipsTable.user_id, userId), eq(organizationMembershipsTable.status, "suspended")))))).returning({
+      organizationId: organizationInvitationsTable.organization_id,
+      roles: organizationInvitationsTable.roles
+    }));
+    const [row] = await db.with(claimed).insert(organizationMembershipsTable).select(db.select({
+      created_at_ms: sql`${now}`.as("created_at_ms"),
+      organization_id: claimed.organizationId,
+      roles: claimed.roles,
+      status: sql`'active'`.as("status"),
+      updated_at_ms: sql`${now}`.as("updated_at_ms"),
+      user_id: sql`${userId}`.as("user_id")
+    }).from(claimed)).onConflictDoUpdate({
+      set: { user_id: userId },
+      target: [
+        organizationMembershipsTable.organization_id,
+        organizationMembershipsTable.user_id
+      ]
+    }).returning();
+    return row && row.status === "active" ? toMembership(row) : undefined;
+  },
   deleteOrganization: async (organizationId) => {
     await db.delete(organizationsTable).where(eq(organizationsTable.organization_id, organizationId));
   },
@@ -41467,6 +41486,30 @@ var createInMemoryOrganizationStore = () => {
   const memberships = new Map;
   const invitations = new Map;
   return {
+    acceptInvitation: async ({ tokenHash, userId, verifiedEmail, now }) => {
+      const invitation = [...invitations.values()].find((value) => value.tokenHash === tokenHash);
+      if (!invitation || invitation.state !== "pending" || invitation.expiresAt <= now || invitation.email.trim().toLowerCase() !== verifiedEmail || !organizations.has(invitation.organizationId))
+        return;
+      const key = membershipKey(invitation.organizationId, userId);
+      const existing = memberships.get(key);
+      if (existing?.status === "suspended")
+        return;
+      const membership = existing ?? {
+        createdAt: now,
+        organizationId: invitation.organizationId,
+        roles: [...invitation.roles],
+        status: "active",
+        updatedAt: now,
+        userId
+      };
+      invitations.set(invitation.invitationId, {
+        ...invitation,
+        acceptedAt: now,
+        state: "accepted"
+      });
+      memberships.set(key, membership);
+      return cloneMembership(membership);
+    },
     deleteOrganization: async (organizationId) => {
       organizations.delete(organizationId);
     },
@@ -42212,5 +42255,5 @@ export {
   userSessionIdTypebox
 };
 
-//# debugId=111690DAA1672B5F64756E2164756E21
+//# debugId=E5C70909EAE2DA0864756E2164756E21
 //# sourceMappingURL=server.js.map