@adonis-agora/authkit-server 1.0.0-rc.6 → 1.0.0-rc.7

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @adonis-agora/authkit-server
 
+## 1.0.0-rc.7
+
+### Minor Changes
+
+- [#465](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/465) [`6bd9575`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/6bd95759752c0fac14a061875abebb38c0e238b7) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - The active organization is published as the request's tenant in `@adonis-agora/context`: `Context.tenant()` returns `{ id, kind: 'organization', source: 'authkit', slug, role }` (and `tenantId` as before). New client option `tenancy`: `eager` resolves the session at request start (default on when `config/context.ts` enables tenancy and the resolver is `jwt`), `personal` makes the user the tenant when there is no active organization (off by default), and `resolve` maps the session to your own (optionally nested) tenants. A tenant the app sets itself with `Context.setTenant` is never overwritten. authkit-server ships `authkitTenantLabels()`, a label resolver for `config/context.ts` → `tenancy.label` that shows organization names in the consoles, and account stores gain the optional `findOrgsByIds` (implemented by the Lucid store).
+
 ## 1.0.0-rc.6
 
 ### Minor Changes

package/build/index.d.ts

@@ -161,4 +161,5 @@ export { ensureAuthkitSchema, ensureAuthkitTables } from './src/schema/ensure.js
 export type { ServiceTenantInfo } from './src/service_tenants/client_metadata.js';
 export type { ResolvedServiceTenantResource, ResolvedServiceTenantsConfig, ServiceTenantResourceInput, ServiceTenantsConfigInput, } from './src/service_tenants/config.js';
 export { AuthkitTenantVerifier, type AuthkitTenantVerifierFn, type AuthkitTenantVerifierOptions, authkitTenantVerifier, type TenantTokenIssuer, type TenantVerifierInput, type VerifiedTenant, } from './src/service_tenants/tenant_verifier.js';
+export { type AuthkitTenantLabelsOptions, authkitTenantLabels, type TenantLabelResolver, } from './src/tenancy/tenant_labels.js';
 export { stubsRoot } from './stubs/main.js';

package/build/index.js

@@ -137,4 +137,5 @@ export { checkClientRegistration, classifyRedirect, RegistrationPolicyError, } f
 export { registerOidcRoutes } from './src/register_routes.js';
 export { ensureAuthkitSchema, ensureAuthkitTables } from './src/schema/ensure.js';
 export { AuthkitTenantVerifier, authkitTenantVerifier, } from './src/service_tenants/tenant_verifier.js';
+export { authkitTenantLabels, } from './src/tenancy/tenant_labels.js';
 export { stubsRoot } from './stubs/main.js';

package/build/src/accounts/account_store.d.ts

@@ -605,6 +605,12 @@ export interface OrganizationsCapability {
     }): Promise<OrgSummary>;
     findOrgById(orgId: string): Promise<OrgSummary | null>;
     findOrgBySlug(slug: string): Promise<OrgSummary | null>;
+    /**
+     * OPTIONAL: the orgs among `orgIds` that exist, in a bounded number of queries
+     * (any order; unknown ids are left out). Absent → callers fall back to
+     * `findOrgById` per id.
+     */
+    findOrgsByIds?(orgIds: readonly string[]): Promise<OrgSummary[]>;
     listOrgsForAccount(accountId: string): Promise<Array<OrgSummary & {
         role: string;
     }>>;

package/build/src/accounts/lucid_store/organizations.js

@@ -137,6 +137,12 @@ export function buildOrganizations(ctx) {
             const row = await OrgModel.find(orgId);
             return row ? toOrgSummary(row) : null;
         },
+        async findOrgsByIds(orgIds) {
+            const ids = [...new Set(orgIds)];
+            if (ids.length === 0)
+                return [];
+            return (await findManyChunked(OrgModel, ids)).map(toOrgSummary);
+        },
         async findOrgBySlug(slug) {
             const row = await OrgModel.query().where('slug', slug).first();
             return row ? toOrgSummary(row) : null;

package/build/src/tenancy/tenant_labels.d.ts

@@ -0,0 +1,30 @@
+import type { AccountStore, OrgSummary } from '../accounts/account_store.js';
+/** What `config/context.ts` → `tenancy.label` expects: tenant id → display label. */
+export type TenantLabelResolver = (ids: readonly string[]) => Promise<Record<string, string>>;
+export interface AuthkitTenantLabelsOptions {
+    /** Which field labels an organization: `'name'` (default), `'slug'`, or your own function. */
+    label?: 'name' | 'slug' | ((org: OrgSummary) => string);
+    /**
+     * Where the account store comes from. Default: the `authkit.server` binding of the
+     * booted app (`config/authkit.ts` → `accountStore`).
+     */
+    store?: () => AccountStore | Promise<AccountStore>;
+}
+/**
+ * A tenant label resolver backed by authkit organizations, for
+ * `config/context.ts` → `tenancy.label`. Consoles call it with the tenant ids they
+ * are about to show; it returns `{ [orgId]: name }` for the ids that are authkit
+ * organizations. Ids it does not know (personal tenants, other kinds) are left
+ * out, so the console shows the id. It only reads labels: no membership, role or
+ * metadata leaves it.
+ *
+ * ```ts
+ * // config/context.ts
+ * import { authkitTenantLabels } from '@adonis-agora/authkit-server'
+ *
+ * export default defineConfig({
+ *   tenancy: { enabled: true, kinds: ['organization'], label: authkitTenantLabels() },
+ * })
+ * ```
+ */
+export declare function authkitTenantLabels(options?: AuthkitTenantLabelsOptions): TenantLabelResolver;

package/build/src/tenancy/tenant_labels.js

@@ -0,0 +1,64 @@
+import { getBootedApp } from '../../services/booted_app.js';
+import { supportsOrganizations } from '../accounts/account_store.js';
+/** Fallback walk without `findOrgsByIds`: one lookup per id, at most this many ids. */
+const FALLBACK_MAX = 200;
+const defaultStore = async () => {
+    const service = (await getBootedApp().container.make('authkit.server'));
+    return service.config.accountStore;
+};
+/**
+ * A tenant label resolver backed by authkit organizations, for
+ * `config/context.ts` → `tenancy.label`. Consoles call it with the tenant ids they
+ * are about to show; it returns `{ [orgId]: name }` for the ids that are authkit
+ * organizations. Ids it does not know (personal tenants, other kinds) are left
+ * out, so the console shows the id. It only reads labels: no membership, role or
+ * metadata leaves it.
+ *
+ * ```ts
+ * // config/context.ts
+ * import { authkitTenantLabels } from '@adonis-agora/authkit-server'
+ *
+ * export default defineConfig({
+ *   tenancy: { enabled: true, kinds: ['organization'], label: authkitTenantLabels() },
+ * })
+ * ```
+ */
+export function authkitTenantLabels(options = {}) {
+    const pick = typeof options.label === 'function'
+        ? options.label
+        : options.label === 'slug'
+            ? (org) => org.slug
+            : (org) => org.name;
+    return async (ids) => {
+        const wanted = [
+            ...new Set((Array.isArray(ids) ? ids : []).filter((id) => typeof id === 'string' && id)),
+        ];
+        if (wanted.length === 0)
+            return {};
+        const store = await (options.store ?? defaultStore)();
+        if (!store || !supportsOrganizations(store))
+            return {};
+        let orgs;
+        if (typeof store.findOrgsByIds === 'function') {
+            orgs = await store.findOrgsByIds(wanted);
+        }
+        else {
+            orgs = [];
+            for (const id of wanted.slice(0, FALLBACK_MAX)) {
+                const org = await store.findOrgById(id);
+                if (org)
+                    orgs.push(org);
+            }
+        }
+        const asked = new Set(wanted);
+        const labels = {};
+        for (const org of orgs) {
+            if (!asked.has(org.id))
+                continue;
+            const label = pick(org);
+            if (typeof label === 'string' && label !== '')
+                labels[org.id] = label;
+        }
+        return labels;
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "1.0.0-rc.6",
+  "version": "1.0.0-rc.7",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",