@adonis-agora/authkit-server 0.82.2 → 0.82.3

package/build/src/accounts/account_store.d.ts

@@ -608,6 +608,18 @@ export interface OrganizationsCapability {
     listOrgsForAccount(accountId: string): Promise<Array<OrgSummary & {
         role: string;
     }>>;
+    /**
+     * OPTIONAL: every org that has at least one member whose account exists, with
+     * its member count, in a bounded number of queries. Must return exactly what
+     * the admin fallback builds by walking `listAccounts` (admin order) and calling
+     * `listOrgsForAccount` per account: orgs in first-seen order, `role` being the
+     * role of the first member seen in that order, `memberCount` being
+     * `listOrgMembers(orgId).length`. Absent → the admin service uses that walk.
+     */
+    listAllOrgsWithMemberCount?(): Promise<Array<OrgSummary & {
+        role: string;
+        memberCount: number;
+    }>>;
     updateOrg(orgId: string, patch: {
         name?: string;
         logoUrl?: string | null;

package/build/src/accounts/lucid_account_store.js

@@ -121,6 +121,35 @@ function resolveAccountTable(Model) {
     }
     return undefined;
 }
+/** Up to this many ids, filter with `WHERE IN`; above it, read every id instead. */
+const ADMIN_ORDER_IN_LIMIT = 500;
+/**
+ * Of `accountIds`, the ones that exist, in the order `listAccounts` pages them
+ * (`ORDER BY email ASC`, sorted by the database so collation matches). One query,
+ * plain rows (no model hydration), primary key only.
+ */
+async function listAccountIdsInAdminOrder(Model, accountIds) {
+    if (accountIds.length === 0)
+        return [];
+    Model.boot?.();
+    const pk = Model.$columnsDefinitions?.get?.('id')?.columnName ?? 'id';
+    const readAll = async () => (await Model.query().select(pk).orderBy('email', 'asc').pojo());
+    let rows;
+    if (accountIds.length <= ADMIN_ORDER_IN_LIMIT) {
+        try {
+            rows = await Model.query().select(pk).whereIn(pk, accountIds).orderBy('email', 'asc').pojo();
+        }
+        catch {
+            // e.g. a member row whose account id doesn't fit the key type: the full read
+            // never binds member ids, exactly like the `listAccounts` walk.
+            rows = await readAll();
+        }
+    }
+    else {
+        rows = await readAll();
+    }
+    return rows.map((row) => String(row[pk]));
+}
 export function lucidAccountStore(Model, options = {}) {
     const mfaIssuer = options.mfaIssuer ?? 'AuthKit';
     const recoveryCodeCount = options.recoveryCodeCount ?? 8;
@@ -242,6 +271,7 @@ export function lucidAccountStore(Model, options = {}) {
                         const row = await Model.find(accountId);
                         return row?.email ?? null;
                     },
+                    listAccountIdsInAdminOrder: (accountIds) => listAccountIdsInAdminOrder(Model, accountIds),
                 }),
             }
             : {}),

package/build/src/accounts/lucid_store/organizations.d.ts

@@ -9,5 +9,11 @@ export interface OrgStoreContext {
     InvitationModel: any;
     /** Mapa accountId → email, para validar aceitação de convite. */
     findAccountEmail: (accountId: string) => Promise<string | null>;
+    /**
+     * Of the given account ids, the ones whose account exists, in the admin
+     * listing order (`listAccounts`: email asc). When present, the store exposes
+     * `listAllOrgsWithMemberCount` (bounded queries for the admin org list).
+     */
+    listAccountIdsInAdminOrder?: (accountIds: string[]) => Promise<string[]>;
 }
 export declare function buildOrganizations(ctx: OrgStoreContext): OrganizationsCapability;

package/build/src/accounts/lucid_store/organizations.js

@@ -1,5 +1,15 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { DateTime } from 'luxon';
+/** Max ids per `WHERE IN` (stays well below every dialect's bind-parameter limit). */
+const IN_CHUNK = 500;
+/** `Model.findMany` in chunks of {@link IN_CHUNK} ids. */
+async function findManyChunked(Model, ids) {
+    const rows = [];
+    for (let i = 0; i < ids.length; i += IN_CHUNK) {
+        rows.push(...(await Model.findMany(ids.slice(i, i + IN_CHUNK))));
+    }
+    return rows;
+}
 function toOrgSummary(row) {
     return {
         id: row.id,
@@ -49,8 +59,62 @@ async function countOwners(MemberModel, orgId) {
     return Number(result[0]?.$extras?.total ?? 0);
 }
 export function buildOrganizations(ctx) {
-    const { OrgModel, MemberModel, InvitationModel, findAccountEmail } = ctx;
+    const { OrgModel, MemberModel, InvitationModel, findAccountEmail, listAccountIdsInAdminOrder } = ctx;
     return {
+        ...(listAccountIdsInAdminOrder
+            ? {
+                /**
+                 * Admin org list in 3 queries (all memberships, the member accounts in
+                 * admin order, the orgs) instead of walking every account. Mirrors the
+                 * fallback in `AdminOrgsService.listOrgs` exactly: accounts in
+                 * `listAccounts` order (email asc), each account's memberships in the
+                 * same (natural) order `listOrgsForAccount` reads them, first sighting of
+                 * an org wins (its `role`), and `memberCount` counts every member row
+                 * (like `listOrgMembers(orgId).length`).
+                 */
+                async listAllOrgsWithMemberCount() {
+                    const memberships = await MemberModel.query();
+                    if (memberships.length === 0)
+                        return [];
+                    const byAccount = new Map();
+                    const memberCount = new Map();
+                    for (const m of memberships) {
+                        const accountId = String(m.accountId);
+                        const orgId = String(m.organizationId);
+                        memberCount.set(orgId, (memberCount.get(orgId) ?? 0) + 1);
+                        const list = byAccount.get(accountId);
+                        if (list)
+                            list.push(m);
+                        else
+                            byAccount.set(accountId, [m]);
+                    }
+                    const accountIds = await listAccountIdsInAdminOrder([...byAccount.keys()]);
+                    const orgs = new Map();
+                    for (const org of await findManyChunked(OrgModel, [...memberCount.keys()])) {
+                        orgs.set(String(org.id), org);
+                    }
+                    const result = [];
+                    const seen = new Set();
+                    for (const accountId of accountIds) {
+                        for (const m of byAccount.get(String(accountId)) ?? []) {
+                            const orgId = String(m.organizationId);
+                            if (seen.has(orgId))
+                                continue;
+                            const org = orgs.get(orgId);
+                            if (!org)
+                                continue;
+                            seen.add(orgId);
+                            result.push({
+                                ...toOrgSummary(org),
+                                role: m.role,
+                                memberCount: memberCount.get(orgId) ?? 0,
+                            });
+                        }
+                    }
+                    return result;
+                },
+            }
+            : {}),
         async createOrg(input) {
             const { randomUUID } = await import('node:crypto');
             const org = await OrgModel.create({

package/build/src/host/admin_api/admin_orgs_service.js

@@ -55,6 +55,11 @@ export class AdminOrgsService {
         const store = this.cfg.accountStore;
         if (!supportsOrganizations(store))
             return { ok: false, reason: 'not_supported' };
+        // Fast path: stores that can answer in a bounded number of queries (the Lucid
+        // store does). Same list, same order as the walk below.
+        if (typeof store.listAllOrgsWithMemberCount === 'function') {
+            return store.listAllOrgsWithMemberCount();
+        }
         // O store não tem listAllOrgs — acumulamos via memberships de todas as contas.
         // Para admin, fazemos um listAccounts full e coletamos todas as orgs únicas.
         // Mais eficiente: usa a tabela de organizations diretamente pelo listOrgMembers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.82.2",
+  "version": "0.82.3",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",