@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/host-email-tokens.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type RenderedHostEmail } from '@aglyn/shared-util-email';
+/**
+ * `renderHostEmail` with `host.*` tokens resolved (AGL-1022).
+ *
+ * The whole point of host variables is that a publisher's email template can
+ * say "write to {{host.supportEmail}}" and have the installing site fill it in.
+ * That only happens if something resolves the tokens at SEND time, and the
+ * email library cannot: `@aglyn/shared-util-email` is `scope:shared` and may
+ * only depend on `scope:shared`, while the token registry is aglyn-scoped.
+ *
+ * So the join happens here, in the one lib that already sits above both. Three
+ * alternatives were weighed and this is the one that cannot fail quietly:
+ *
+ * * A registration hook inside the email library would mean a provider that is
+ *   never registered resolves every token to nothing, silently, on a path whose
+ *   output has already been sent to a customer. This repo has shipped a
+ *   flawless security control with zero callers before; that is the shape.
+ * * Threading the map through all eighteen call sites puts the burden on
+ *   whoever adds the nineteenth, and they will not know.
+ * * Moving the registry into a `scope:shared` lib is the cleanest end state and
+ *   the right thing if a second shared consumer ever appears — but the only
+ *   candidate today is `shared/util/tools`, which is generic helpers, and
+ *   domain logic does not belong there.
+ *
+ * Costs one host read per send. Emails are not a hot path, and the read buys
+ * the guarantee that a template's branding is right by construction.
+ */
+export declare function renderHostEmailWithTokens(firestore: FirebaseFirestore.Firestore, hostId: string, templateKey: string, merge?: Record<string, string>, options?: {
+    origin?: string;
+}): Promise<RenderedHostEmail | null>;
+export default renderHostEmailWithTokens;

package/src/lib/server/host-email-tokens.js

@@ -0,0 +1,72 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { sanitizeAuthorHtml } from "@aglyn/aglyn/app-utils/author-html";
+import { hostTokenMerge } from "@aglyn/aglyn/app-utils/host-tokens";
+import { renderHostEmail } from "@aglyn/shared-util-email";
+/**
+ * `renderHostEmail` with `host.*` tokens resolved (AGL-1022).
+ *
+ * The whole point of host variables is that a publisher's email template can
+ * say "write to {{host.supportEmail}}" and have the installing site fill it in.
+ * That only happens if something resolves the tokens at SEND time, and the
+ * email library cannot: `@aglyn/shared-util-email` is `scope:shared` and may
+ * only depend on `scope:shared`, while the token registry is aglyn-scoped.
+ *
+ * So the join happens here, in the one lib that already sits above both. Three
+ * alternatives were weighed and this is the one that cannot fail quietly:
+ *
+ * * A registration hook inside the email library would mean a provider that is
+ *   never registered resolves every token to nothing, silently, on a path whose
+ *   output has already been sent to a customer. This repo has shipped a
+ *   flawless security control with zero callers before; that is the shape.
+ * * Threading the map through all eighteen call sites puts the burden on
+ *   whoever adds the nineteenth, and they will not know.
+ * * Moving the registry into a `scope:shared` lib is the cleanest end state and
+ *   the right thing if a second shared consumer ever appears — but the only
+ *   candidate today is `shared/util/tools`, which is generic helpers, and
+ *   domain logic does not belong there.
+ *
+ * Costs one host read per send. Emails are not a hot path, and the read buys
+ * the guarantee that a template's branding is right by construction.
+ */ export async function renderHostEmailWithTokens(firestore, hostId, templateKey, merge = {}, options = {}) {
+    let host;
+    try {
+        const snapshot = await firestore.collection('hosts').doc(hostId).get();
+        host = snapshot.exists ? snapshot.data() : null;
+    } catch (unused) {
+        // A failed read must not stop the send. Every token then resolves to its
+        // empty behaviour, which is the same outcome as a site that set nothing —
+        // an email with a gap where the address would be, rather than no email.
+        host = null;
+    }
+    return renderHostEmail(firestore, hostId, templateKey, // Host tokens first: an explicit caller value WINS. A sender passing
+    // `host.businessName` is naming a specific thing on purpose (a white-label
+    // send, a preview with sample data), and this is not the place to overrule
+    // it.
+    _extends({}, hostTokenMerge(host), merge), // The HTML policy joins here for the same reason the token map does, and
+    // it is the same reason: `renderEmailHtml` requires one, `scope:shared`
+    // cannot import one, and this lib already sits above both. Supplying it
+    // here rather than at each of the nine senders keeps their signatures
+    // untouched and gives the tenth one the right policy without knowing it
+    // needed to ask.
+    _extends({}, options, {
+        sanitize: sanitizeAuthorHtml
+    }));
+}
+export default renderHostEmailWithTokens;
+
+//# sourceMappingURL=host-email-tokens.js.map

package/src/lib/server/host-email-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/host-email-tokens.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { sanitizeAuthorHtml } from '@aglyn/aglyn/app-utils/author-html'\nimport {\n  hostTokenMerge,\n  type HostTokenSource,\n} from '@aglyn/aglyn/app-utils/host-tokens'\nimport {\n  renderHostEmail,\n  type RenderedHostEmail,\n} from '@aglyn/shared-util-email'\nimport { firebaseAdmin } from './firebase-admin'\n\n/**\n * `renderHostEmail` with `host.*` tokens resolved (AGL-1022).\n *\n * The whole point of host variables is that a publisher's email template can\n * say \"write to {{host.supportEmail}}\" and have the installing site fill it in.\n * That only happens if something resolves the tokens at SEND time, and the\n * email library cannot: `@aglyn/shared-util-email` is `scope:shared` and may\n * only depend on `scope:shared`, while the token registry is aglyn-scoped.\n *\n * So the join happens here, in the one lib that already sits above both. Three\n * alternatives were weighed and this is the one that cannot fail quietly:\n *\n * * A registration hook inside the email library would mean a provider that is\n *   never registered resolves every token to nothing, silently, on a path whose\n *   output has already been sent to a customer. This repo has shipped a\n *   flawless security control with zero callers before; that is the shape.\n * * Threading the map through all eighteen call sites puts the burden on\n *   whoever adds the nineteenth, and they will not know.\n * * Moving the registry into a `scope:shared` lib is the cleanest end state and\n *   the right thing if a second shared consumer ever appears — but the only\n *   candidate today is `shared/util/tools`, which is generic helpers, and\n *   domain logic does not belong there.\n *\n * Costs one host read per send. Emails are not a hot path, and the read buys\n * the guarantee that a template's branding is right by construction.\n */\nexport async function renderHostEmailWithTokens(\n  firestore: FirebaseFirestore.Firestore,\n  hostId: string,\n  templateKey: string,\n  merge: Record<string, string> = {},\n  options: { origin?: string } = {},\n): Promise<RenderedHostEmail | null> {\n  let host: HostTokenSource | null\n  try {\n    const snapshot = await firestore.collection('hosts').doc(hostId).get()\n    host = snapshot.exists ? (snapshot.data() as HostTokenSource) : null\n  } catch {\n    // A failed read must not stop the send. Every token then resolves to its\n    // empty behaviour, which is the same outcome as a site that set nothing —\n    // an email with a gap where the address would be, rather than no email.\n    host = null\n  }\n  return renderHostEmail(\n    firestore as never,\n    hostId,\n    templateKey,\n    // Host tokens first: an explicit caller value WINS. A sender passing\n    // `host.businessName` is naming a specific thing on purpose (a white-label\n    // send, a preview with sample data), and this is not the place to overrule\n    // it.\n    { ...hostTokenMerge(host), ...merge },\n    // The HTML policy joins here for the same reason the token map does, and\n    // it is the same reason: `renderEmailHtml` requires one, `scope:shared`\n    // cannot import one, and this lib already sits above both. Supplying it\n    // here rather than at each of the nine senders keeps their signatures\n    // untouched and gives the tenth one the right policy without knowing it\n    // needed to ask.\n    { ...options, sanitize: sanitizeAuthorHtml },\n  )\n}\n\nexport default renderHostEmailWithTokens\n"],"names":["sanitizeAuthorHtml","hostTokenMerge","renderHostEmail","renderHostEmailWithTokens","firestore","hostId","templateKey","merge","options","host","snapshot","collection","doc","get","exists","data","sanitize"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,kBAAkB,QAAQ,qCAAoC;AACvE,SACEC,cAAc,QAET,qCAAoC;AAC3C,SACEC,eAAe,QAEV,2BAA0B;AAGjC;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,eAAeC,0BACpBC,SAAsC,EACtCC,MAAc,EACdC,WAAmB,EACnBC,QAAgC,CAAC,CAAC,EAClCC,UAA+B,CAAC,CAAC;IAEjC,IAAIC;IACJ,IAAI;QACF,MAAMC,WAAW,MAAMN,UAAUO,UAAU,CAAC,SAASC,GAAG,CAACP,QAAQQ,GAAG;QACpEJ,OAAOC,SAASI,MAAM,GAAIJ,SAASK,IAAI,KAAyB;IAClE,EAAE,eAAM;QACN,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxEN,OAAO;IACT;IACA,OAAOP,gBACLE,WACAC,QACAC,aACA,qEAAqE;IACrE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM;IACN,aAAKL,eAAeQ,OAAUF,QAC9B,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,iBAAiB;IACjB,aAAKC;QAASQ,UAAUhB;;AAE5B;AAEA,eAAeG,0BAAyB"}

package/src/lib/server/host-memberships.d.ts

@@ -0,0 +1,54 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { FieldValue } from 'firebase-admin/firestore';
+interface HostMeta {
+    displayName?: string;
+    subdomain?: string;
+    favicon?: string;
+}
+/**
+ * Shape one projection row. Exported for tests: the favicon rule below is a
+ * delete-vs-omit decision that is invisible in review and silent in
+ * production when wrong (AGL-1071).
+ */
+export declare const membershipRow: (orgId: string, meta: HostMeta | undefined, role: string) => {
+    displayName: string;
+    nameLower: string;
+    favicon: string | FieldValue;
+    role: string;
+    updatedAt: FieldValue;
+    subdomain?: string;
+    orgId: string;
+};
+/**
+ * Re-sync ONE member's projection rows across all the org's hosts: set a row
+ * for every host the member can reach, delete the row for every host they
+ * cannot (a role downgrade silently drops hosts). Call after any change to a
+ * single member (add / role change / grant / revoke / ownership step).
+ */
+export declare function syncMemberHostProjections(orgId: string, uid: string): Promise<void>;
+/**
+ * Re-sync ONE host's projection rows across all org members: set a row for
+ * every member who can reach it, delete for those who cannot. Call after a
+ * host is created, renamed, or its displayName changes.
+ */
+export declare function syncHostProjectionForMembers(orgId: string, hostId: string): Promise<void>;
+/** Delete every projection row for a member across the org's hosts (member removed). */
+export declare function deleteMemberHostProjections(orgId: string, uid: string): Promise<void>;
+/** Delete every member's projection row for one host (host erased). */
+export declare function deleteHostProjectionForAllMembers(orgId: string, hostId: string): Promise<void>;
+export {};

package/src/lib/server/host-memberships.js

@@ -0,0 +1,194 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Per-user host membership projection (AGL-844): a reverse index at
+ * `users/{uid}/hostMemberships/{hostId}` mirroring `hosts/{hostId}.memberRoles`
+ * — the hosts a user can reach in an org, denormalized with the name so the
+ * site switcher and subdomain→id routing can query + order + name-prefix-search
+ * a user's own sites without loading the whole `hosts` collection (which the
+ * rules can only serve unordered under a per-user `memberRoles.{uid}` filter).
+ *
+ * Because it lives under the user's own doc it is owner-readable and already
+ * membership-filtered, so `where(orgId==…) orderBy(nameLower|updatedAt)` is a
+ * plain composite index (no dynamic map path). Admin-SDK-written only.
+ *
+ * It is a best-effort convenience index, NOT an authorization source: real
+ * access stays gated by `hosts/{hostId}.memberRoles` in the rules, so a stale
+ * row at worst shows a site that then 404s on read — never grants access.
+ *
+ * Writers are scoped, mirroring the `users/{uid}/orgs` reverse index: a member
+ * change re-syncs THAT member across the org's hosts; a host change re-syncs
+ * THAT host across members. Kept in sync at the same points as `memberRoles`
+ * (see `syncHostMemberRoles` callers) plus the erase/displayName gaps (AGL-855).
+ */ import { hostRoleFor, isOrgWideMember, nameSearchKey } from "@aglyn/aglyn/server";
+import { FieldValue } from "firebase-admin/firestore";
+import firebaseAdmin from "./firebase-admin.js";
+const firestore = ()=>firebaseAdmin.app().firestore();
+/** Firestore caps a batch at 500 writes; commit in chunks below that. */ const CHUNK = 400;
+const orgHostIds = async (db, orgId)=>{
+    var _ref;
+    const org = (await db.collection('orgs').doc(orgId).get()).data();
+    return Object.keys((_ref = org == null ? void 0 : org.hosts) != null ? _ref : {});
+};
+const readHostMeta = async (db, hostIds)=>{
+    if (hostIds.length === 0) return new Map();
+    const snaps = await db.getAll(...hostIds.map((id)=>db.collection('hosts').doc(id)));
+    return new Map(snaps.map((snap)=>{
+        var _snap_get;
+        return [
+            snap.id,
+            {
+                displayName: snap.get('displayName'),
+                subdomain: snap.get('subdomain'),
+                // The switcher renders from the projection, not the host doc, so the
+                // favicon has to travel with it (AGL-1071).
+                favicon: (_snap_get = snap.get('seo')) == null ? void 0 : _snap_get.favicon
+            }
+        ];
+    }));
+};
+const listMembers = async (db, orgId)=>{
+    const snap = await db.collection('orgs').doc(orgId).collection('members').get();
+    return snap.docs.map((d)=>_extends({
+            $id: d.id
+        }, d.data()));
+};
+const membershipRef = (db, uid, hostId)=>db.collection('users').doc(uid).collection('hostMemberships').doc(hostId);
+/**
+ * Shape one projection row. Exported for tests: the favicon rule below is a
+ * delete-vs-omit decision that is invisible in review and silent in
+ * production when wrong (AGL-1071).
+ */ export const membershipRow = (orgId, meta, role)=>{
+    var _ref;
+    const displayName = (_ref = meta == null ? void 0 : meta.displayName) != null ? _ref : '';
+    return _extends({
+        orgId
+    }, (meta == null ? void 0 : meta.subdomain) ? {
+        subdomain: meta.subdomain
+    } : {}, {
+        displayName,
+        nameLower: nameSearchKey(displayName),
+        // DELETE rather than omit when the site has no favicon (AGL-1071). These
+        // rows are written with `{ merge: true }`, so omitting the key leaves
+        // whatever was there — clearing a favicon would keep showing the old one
+        // in the switcher until something unrelated rewrote the row. The clear
+        // path writes `seo.favicon: ''`, so test truthiness, not nullishness.
+        favicon: (meta == null ? void 0 : meta.favicon) ? meta.favicon : FieldValue.delete(),
+        role,
+        updatedAt: FieldValue.serverTimestamp()
+    });
+};
+/** Runs a set of write operations in ≤CHUNK-sized batches. */ const commitChunked = async (db, ops)=>{
+    for(let i = 0; i < ops.length; i += CHUNK){
+        const batch = db.batch();
+        for (const op of ops.slice(i, i + CHUNK))op(batch);
+        await batch.commit();
+    }
+};
+/**
+ * Mirror the member's org-wide reach onto their `users/{uid}/orgs/{orgId}`
+ * row (AGL-1032), so the console can tell a site collaborator from an
+ * org-wide viewer without a second read on every org route.
+ *
+ * Rides the projection pass rather than being a call the membership APIs
+ * each have to remember: every path that changes a member's reach — add,
+ * role change, grant, revoke, ownership transfer — already re-syncs their
+ * host rows, so one funnel keeps the mirror true and self-heals a row an
+ * earlier failure left stale.
+ *
+ * Only ever UPDATES an existing row. The reverse index is created with the
+ * membership and deleted with it; a `set`/merge here on a removed member
+ * would resurrect a half-row with no `orgName` or `slug`, and the console
+ * renders that as a nameless workspace nobody can open.
+ */ async function syncMemberOrgReach(db, orgId, uid, member) {
+    if (!member) return;
+    const ref = db.collection('users').doc(uid).collection('orgs').doc(orgId);
+    const snap = await ref.get();
+    if (!snap.exists) return;
+    const orgWide = isOrgWideMember(member);
+    if (snap.get('orgWide') === orgWide) return;
+    await ref.set({
+        orgWide
+    }, {
+        merge: true
+    });
+}
+/**
+ * Re-sync ONE member's projection rows across all the org's hosts: set a row
+ * for every host the member can reach, delete the row for every host they
+ * cannot (a role downgrade silently drops hosts). Call after any change to a
+ * single member (add / role change / grant / revoke / ownership step).
+ */ export async function syncMemberHostProjections(orgId, uid) {
+    const db = firestore();
+    const [memberSnap, hostIds] = await Promise.all([
+        db.collection('orgs').doc(orgId).collection('members').doc(uid).get(),
+        orgHostIds(db, orgId)
+    ]);
+    const member = memberSnap.exists ? _extends({
+        $id: uid
+    }, memberSnap.data()) : null;
+    await syncMemberOrgReach(db, orgId, uid, member);
+    const meta = await readHostMeta(db, hostIds);
+    const ops = hostIds.map((hostId)=>(batch)=>{
+            const role = hostRoleFor(member, hostId);
+            const ref = membershipRef(db, uid, hostId);
+            if (role) batch.set(ref, membershipRow(orgId, meta.get(hostId), role), {
+                merge: true
+            });
+            else batch.delete(ref);
+        });
+    await commitChunked(db, ops);
+}
+/**
+ * Re-sync ONE host's projection rows across all org members: set a row for
+ * every member who can reach it, delete for those who cannot. Call after a
+ * host is created, renamed, or its displayName changes.
+ */ export async function syncHostProjectionForMembers(orgId, hostId) {
+    const db = firestore();
+    const [members, meta] = await Promise.all([
+        listMembers(db, orgId),
+        readHostMeta(db, [
+            hostId
+        ])
+    ]);
+    const hostMeta = meta.get(hostId);
+    const ops = members.map((member)=>(batch)=>{
+            const role = hostRoleFor(member, hostId);
+            const ref = membershipRef(db, member.$id, hostId);
+            if (role) batch.set(ref, membershipRow(orgId, hostMeta, role), {
+                merge: true
+            });
+            else batch.delete(ref);
+        });
+    await commitChunked(db, ops);
+}
+/** Delete every projection row for a member across the org's hosts (member removed). */ export async function deleteMemberHostProjections(orgId, uid) {
+    const db = firestore();
+    const hostIds = await orgHostIds(db, orgId);
+    await commitChunked(db, hostIds.map((hostId)=>(batch)=>{
+            batch.delete(membershipRef(db, uid, hostId));
+        }));
+}
+/** Delete every member's projection row for one host (host erased). */ export async function deleteHostProjectionForAllMembers(orgId, hostId) {
+    const db = firestore();
+    const members = await listMembers(db, orgId);
+    await commitChunked(db, members.map((member)=>(batch)=>{
+            batch.delete(membershipRef(db, member.$id, hostId));
+        }));
+}
+
+//# sourceMappingURL=host-memberships.js.map

package/src/lib/server/host-memberships.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/host-memberships.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Per-user host membership projection (AGL-844): a reverse index at\n * `users/{uid}/hostMemberships/{hostId}` mirroring `hosts/{hostId}.memberRoles`\n * — the hosts a user can reach in an org, denormalized with the name so the\n * site switcher and subdomain→id routing can query + order + name-prefix-search\n * a user's own sites without loading the whole `hosts` collection (which the\n * rules can only serve unordered under a per-user `memberRoles.{uid}` filter).\n *\n * Because it lives under the user's own doc it is owner-readable and already\n * membership-filtered, so `where(orgId==…) orderBy(nameLower|updatedAt)` is a\n * plain composite index (no dynamic map path). Admin-SDK-written only.\n *\n * It is a best-effort convenience index, NOT an authorization source: real\n * access stays gated by `hosts/{hostId}.memberRoles` in the rules, so a stale\n * row at worst shows a site that then 404s on read — never grants access.\n *\n * Writers are scoped, mirroring the `users/{uid}/orgs` reverse index: a member\n * change re-syncs THAT member across the org's hosts; a host change re-syncs\n * THAT host across members. Kept in sync at the same points as `memberRoles`\n * (see `syncHostMemberRoles` callers) plus the erase/displayName gaps (AGL-855).\n */\n\nimport {\n  hostRoleFor,\n  isOrgWideMember,\n  nameSearchKey,\n  type AglynOrganization,\n  type AglynOrgMember,\n} from '@aglyn/aglyn/server'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\n/** Firestore caps a batch at 500 writes; commit in chunks below that. */\nconst CHUNK = 400\n\ninterface HostMeta {\n  displayName?: string\n  subdomain?: string\n  favicon?: string\n}\n\nconst orgHostIds = async (\n  db: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<string[]> => {\n  const org = (await db.collection('orgs').doc(orgId).get()).data() as\n    | AglynOrganization\n    | undefined\n  return Object.keys(org?.hosts ?? {})\n}\n\nconst readHostMeta = async (\n  db: FirebaseFirestore.Firestore,\n  hostIds: string[],\n): Promise<Map<string, HostMeta>> => {\n  if (hostIds.length === 0) return new Map()\n  const snaps = await db.getAll(\n    ...hostIds.map((id) => db.collection('hosts').doc(id)),\n  )\n  return new Map(\n    snaps.map((snap) => [\n      snap.id,\n      {\n        displayName: snap.get('displayName'),\n        subdomain: snap.get('subdomain'),\n        // The switcher renders from the projection, not the host doc, so the\n        // favicon has to travel with it (AGL-1071).\n        favicon: snap.get('seo')?.favicon,\n      },\n    ]),\n  )\n}\n\nconst listMembers = async (\n  db: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<AglynOrgMember[]> => {\n  const snap = await db\n    .collection('orgs')\n    .doc(orgId)\n    .collection('members')\n    .get()\n  return snap.docs.map((d) => ({ $id: d.id, ...d.data() }) as AglynOrgMember)\n}\n\nconst membershipRef = (\n  db: FirebaseFirestore.Firestore,\n  uid: string,\n  hostId: string,\n) => db.collection('users').doc(uid).collection('hostMemberships').doc(hostId)\n\n/**\n * Shape one projection row. Exported for tests: the favicon rule below is a\n * delete-vs-omit decision that is invisible in review and silent in\n * production when wrong (AGL-1071).\n */\nexport const membershipRow = (\n  orgId: string,\n  meta: HostMeta | undefined,\n  role: string,\n) => {\n  const displayName = meta?.displayName ?? ''\n  return {\n    orgId,\n    ...(meta?.subdomain ? { subdomain: meta.subdomain } : {}),\n    displayName,\n    nameLower: nameSearchKey(displayName),\n    // DELETE rather than omit when the site has no favicon (AGL-1071). These\n    // rows are written with `{ merge: true }`, so omitting the key leaves\n    // whatever was there — clearing a favicon would keep showing the old one\n    // in the switcher until something unrelated rewrote the row. The clear\n    // path writes `seo.favicon: ''`, so test truthiness, not nullishness.\n    favicon: meta?.favicon ? meta.favicon : FieldValue.delete(),\n    role,\n    updatedAt: FieldValue.serverTimestamp(),\n  }\n}\n\n/** Runs a set of write operations in ≤CHUNK-sized batches. */\nconst commitChunked = async (\n  db: FirebaseFirestore.Firestore,\n  ops: Array<(batch: FirebaseFirestore.WriteBatch) => void>,\n): Promise<void> => {\n  for (let i = 0; i < ops.length; i += CHUNK) {\n    const batch = db.batch()\n    for (const op of ops.slice(i, i + CHUNK)) op(batch)\n    await batch.commit()\n  }\n}\n\n/**\n * Mirror the member's org-wide reach onto their `users/{uid}/orgs/{orgId}`\n * row (AGL-1032), so the console can tell a site collaborator from an\n * org-wide viewer without a second read on every org route.\n *\n * Rides the projection pass rather than being a call the membership APIs\n * each have to remember: every path that changes a member's reach — add,\n * role change, grant, revoke, ownership transfer — already re-syncs their\n * host rows, so one funnel keeps the mirror true and self-heals a row an\n * earlier failure left stale.\n *\n * Only ever UPDATES an existing row. The reverse index is created with the\n * membership and deleted with it; a `set`/merge here on a removed member\n * would resurrect a half-row with no `orgName` or `slug`, and the console\n * renders that as a nameless workspace nobody can open.\n */\nasync function syncMemberOrgReach(\n  db: FirebaseFirestore.Firestore,\n  orgId: string,\n  uid: string,\n  member: AglynOrgMember | null,\n): Promise<void> {\n  if (!member) return\n  const ref = db.collection('users').doc(uid).collection('orgs').doc(orgId)\n  const snap = await ref.get()\n  if (!snap.exists) return\n  const orgWide = isOrgWideMember(member)\n  if (snap.get('orgWide') === orgWide) return\n  await ref.set({ orgWide }, { merge: true })\n}\n\n/**\n * Re-sync ONE member's projection rows across all the org's hosts: set a row\n * for every host the member can reach, delete the row for every host they\n * cannot (a role downgrade silently drops hosts). Call after any change to a\n * single member (add / role change / grant / revoke / ownership step).\n */\nexport async function syncMemberHostProjections(\n  orgId: string,\n  uid: string,\n): Promise<void> {\n  const db = firestore()\n  const [memberSnap, hostIds] = await Promise.all([\n    db.collection('orgs').doc(orgId).collection('members').doc(uid).get(),\n    orgHostIds(db, orgId),\n  ])\n  const member = memberSnap.exists\n    ? ({ $id: uid, ...memberSnap.data() } as AglynOrgMember)\n    : null\n  await syncMemberOrgReach(db, orgId, uid, member)\n  const meta = await readHostMeta(db, hostIds)\n  const ops = hostIds.map((hostId) => (batch: FirebaseFirestore.WriteBatch) => {\n    const role = hostRoleFor(member, hostId)\n    const ref = membershipRef(db, uid, hostId)\n    if (role) batch.set(ref, membershipRow(orgId, meta.get(hostId), role), { merge: true })\n    else batch.delete(ref)\n  })\n  await commitChunked(db, ops)\n}\n\n/**\n * Re-sync ONE host's projection rows across all org members: set a row for\n * every member who can reach it, delete for those who cannot. Call after a\n * host is created, renamed, or its displayName changes.\n */\nexport async function syncHostProjectionForMembers(\n  orgId: string,\n  hostId: string,\n): Promise<void> {\n  const db = firestore()\n  const [members, meta] = await Promise.all([\n    listMembers(db, orgId),\n    readHostMeta(db, [hostId]),\n  ])\n  const hostMeta = meta.get(hostId)\n  const ops = members.map((member) => (batch: FirebaseFirestore.WriteBatch) => {\n    const role = hostRoleFor(member, hostId)\n    const ref = membershipRef(db, member.$id, hostId)\n    if (role) batch.set(ref, membershipRow(orgId, hostMeta, role), { merge: true })\n    else batch.delete(ref)\n  })\n  await commitChunked(db, ops)\n}\n\n/** Delete every projection row for a member across the org's hosts (member removed). */\nexport async function deleteMemberHostProjections(\n  orgId: string,\n  uid: string,\n): Promise<void> {\n  const db = firestore()\n  const hostIds = await orgHostIds(db, orgId)\n  await commitChunked(\n    db,\n    hostIds.map((hostId) => (batch: FirebaseFirestore.WriteBatch) => {\n      batch.delete(membershipRef(db, uid, hostId))\n    }),\n  )\n}\n\n/** Delete every member's projection row for one host (host erased). */\nexport async function deleteHostProjectionForAllMembers(\n  orgId: string,\n  hostId: string,\n): Promise<void> {\n  const db = firestore()\n  const members = await listMembers(db, orgId)\n  await commitChunked(\n    db,\n    members.map((member) => (batch: FirebaseFirestore.WriteBatch) => {\n      batch.delete(membershipRef(db, member.$id, hostId))\n    }),\n  )\n}\n"],"names":["hostRoleFor","isOrgWideMember","nameSearchKey","FieldValue","firebaseAdmin","firestore","app","CHUNK","orgHostIds","db","orgId","org","collection","doc","get","data","Object","keys","hosts","readHostMeta","hostIds","length","Map","snaps","getAll","map","id","snap","displayName","subdomain","favicon","listMembers","docs","d","$id","membershipRef","uid","hostId","membershipRow","meta","role","nameLower","delete","updatedAt","serverTimestamp","commitChunked","ops","i","batch","op","slice","commit","syncMemberOrgReach","member","ref","exists","orgWide","set","merge","syncMemberHostProjections","memberSnap","Promise","all","syncHostProjectionForMembers","members","hostMeta","deleteMemberHostProjections","deleteHostProjectionForAllMembers"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,SACEA,WAAW,EACXC,eAAe,EACfC,aAAa,QAGR,sBAAqB;AAC5B,SAASC,UAAU,QAAQ,2BAA0B;AACrD,OAAOC,mBAAmB,sBAAkB;AAE5C,MAAMC,YAAY,IAAMD,cAAcE,GAAG,GAAGD,SAAS;AAErD,uEAAuE,GACvE,MAAME,QAAQ;AAQd,MAAMC,aAAa,OACjBC,IACAC;;IAEA,MAAMC,MAAM,AAAC,CAAA,MAAMF,GAAGG,UAAU,CAAC,QAAQC,GAAG,CAACH,OAAOI,GAAG,EAAC,EAAGC,IAAI;IAG/D,OAAOC,OAAOC,IAAI,SAACN,uBAAAA,IAAKO,KAAK,mBAAI,CAAC;AACpC;AAEA,MAAMC,eAAe,OACnBV,IACAW;IAEA,IAAIA,QAAQC,MAAM,KAAK,GAAG,OAAO,IAAIC;IACrC,MAAMC,QAAQ,MAAMd,GAAGe,MAAM,IACxBJ,QAAQK,GAAG,CAAC,CAACC,KAAOjB,GAAGG,UAAU,CAAC,SAASC,GAAG,CAACa;IAEpD,OAAO,IAAIJ,IACTC,MAAME,GAAG,CAAC,CAACE;YAOEA;eAPO;YAClBA,KAAKD,EAAE;YACP;gBACEE,aAAaD,KAAKb,GAAG,CAAC;gBACtBe,WAAWF,KAAKb,GAAG,CAAC;gBACpB,qEAAqE;gBACrE,4CAA4C;gBAC5CgB,OAAO,GAAEH,YAAAA,KAAKb,GAAG,CAAC,2BAATa,UAAiBG,OAAO;YACnC;SACD;;AAEL;AAEA,MAAMC,cAAc,OAClBtB,IACAC;IAEA,MAAMiB,OAAO,MAAMlB,GAChBG,UAAU,CAAC,QACXC,GAAG,CAACH,OACJE,UAAU,CAAC,WACXE,GAAG;IACN,OAAOa,KAAKK,IAAI,CAACP,GAAG,CAAC,CAACQ,IAAO;YAAEC,KAAKD,EAAEP,EAAE;WAAKO,EAAElB,IAAI;AACrD;AAEA,MAAMoB,gBAAgB,CACpB1B,IACA2B,KACAC,SACG5B,GAAGG,UAAU,CAAC,SAASC,GAAG,CAACuB,KAAKxB,UAAU,CAAC,mBAAmBC,GAAG,CAACwB;AAEvE;;;;CAIC,GACD,OAAO,MAAMC,gBAAgB,CAC3B5B,OACA6B,MACAC;;IAEA,MAAMZ,sBAAcW,wBAAAA,KAAMX,WAAW,mBAAI;IACzC,OAAO;QACLlB;OACI6B,CAAAA,wBAAAA,KAAMV,SAAS,IAAG;QAAEA,WAAWU,KAAKV,SAAS;IAAC,IAAI,CAAC;QACvDD;QACAa,WAAWvC,cAAc0B;QACzB,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtEE,SAASS,CAAAA,wBAAAA,KAAMT,OAAO,IAAGS,KAAKT,OAAO,GAAG3B,WAAWuC,MAAM;QACzDF;QACAG,WAAWxC,WAAWyC,eAAe;;AAEzC,EAAC;AAED,4DAA4D,GAC5D,MAAMC,gBAAgB,OACpBpC,IACAqC;IAEA,IAAK,IAAIC,IAAI,GAAGA,IAAID,IAAIzB,MAAM,EAAE0B,KAAKxC,MAAO;QAC1C,MAAMyC,QAAQvC,GAAGuC,KAAK;QACtB,KAAK,MAAMC,MAAMH,IAAII,KAAK,CAACH,GAAGA,IAAIxC,OAAQ0C,GAAGD;QAC7C,MAAMA,MAAMG,MAAM;IACpB;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,eAAeC,mBACb3C,EAA+B,EAC/BC,KAAa,EACb0B,GAAW,EACXiB,MAA6B;IAE7B,IAAI,CAACA,QAAQ;IACb,MAAMC,MAAM7C,GAAGG,UAAU,CAAC,SAASC,GAAG,CAACuB,KAAKxB,UAAU,CAAC,QAAQC,GAAG,CAACH;IACnE,MAAMiB,OAAO,MAAM2B,IAAIxC,GAAG;IAC1B,IAAI,CAACa,KAAK4B,MAAM,EAAE;IAClB,MAAMC,UAAUvD,gBAAgBoD;IAChC,IAAI1B,KAAKb,GAAG,CAAC,eAAe0C,SAAS;IACrC,MAAMF,IAAIG,GAAG,CAAC;QAAED;IAAQ,GAAG;QAAEE,OAAO;IAAK;AAC3C;AAEA;;;;;CAKC,GACD,OAAO,eAAeC,0BACpBjD,KAAa,EACb0B,GAAW;IAEX,MAAM3B,KAAKJ;IACX,MAAM,CAACuD,YAAYxC,QAAQ,GAAG,MAAMyC,QAAQC,GAAG,CAAC;QAC9CrD,GAAGG,UAAU,CAAC,QAAQC,GAAG,CAACH,OAAOE,UAAU,CAAC,WAAWC,GAAG,CAACuB,KAAKtB,GAAG;QACnEN,WAAWC,IAAIC;KAChB;IACD,MAAM2C,SAASO,WAAWL,MAAM,GAC3B;QAAErB,KAAKE;OAAQwB,WAAW7C,IAAI,MAC/B;IACJ,MAAMqC,mBAAmB3C,IAAIC,OAAO0B,KAAKiB;IACzC,MAAMd,OAAO,MAAMpB,aAAaV,IAAIW;IACpC,MAAM0B,MAAM1B,QAAQK,GAAG,CAAC,CAACY,SAAW,CAACW;YACnC,MAAMR,OAAOxC,YAAYqD,QAAQhB;YACjC,MAAMiB,MAAMnB,cAAc1B,IAAI2B,KAAKC;YACnC,IAAIG,MAAMQ,MAAMS,GAAG,CAACH,KAAKhB,cAAc5B,OAAO6B,KAAKzB,GAAG,CAACuB,SAASG,OAAO;gBAAEkB,OAAO;YAAK;iBAChFV,MAAMN,MAAM,CAACY;QACpB;IACA,MAAMT,cAAcpC,IAAIqC;AAC1B;AAEA;;;;CAIC,GACD,OAAO,eAAeiB,6BACpBrD,KAAa,EACb2B,MAAc;IAEd,MAAM5B,KAAKJ;IACX,MAAM,CAAC2D,SAASzB,KAAK,GAAG,MAAMsB,QAAQC,GAAG,CAAC;QACxC/B,YAAYtB,IAAIC;QAChBS,aAAaV,IAAI;YAAC4B;SAAO;KAC1B;IACD,MAAM4B,WAAW1B,KAAKzB,GAAG,CAACuB;IAC1B,MAAMS,MAAMkB,QAAQvC,GAAG,CAAC,CAAC4B,SAAW,CAACL;YACnC,MAAMR,OAAOxC,YAAYqD,QAAQhB;YACjC,MAAMiB,MAAMnB,cAAc1B,IAAI4C,OAAOnB,GAAG,EAAEG;YAC1C,IAAIG,MAAMQ,MAAMS,GAAG,CAACH,KAAKhB,cAAc5B,OAAOuD,UAAUzB,OAAO;gBAAEkB,OAAO;YAAK;iBACxEV,MAAMN,MAAM,CAACY;QACpB;IACA,MAAMT,cAAcpC,IAAIqC;AAC1B;AAEA,sFAAsF,GACtF,OAAO,eAAeoB,4BACpBxD,KAAa,EACb0B,GAAW;IAEX,MAAM3B,KAAKJ;IACX,MAAMe,UAAU,MAAMZ,WAAWC,IAAIC;IACrC,MAAMmC,cACJpC,IACAW,QAAQK,GAAG,CAAC,CAACY,SAAW,CAACW;YACvBA,MAAMN,MAAM,CAACP,cAAc1B,IAAI2B,KAAKC;QACtC;AAEJ;AAEA,qEAAqE,GACrE,OAAO,eAAe8B,kCACpBzD,KAAa,EACb2B,MAAc;IAEd,MAAM5B,KAAKJ;IACX,MAAM2D,UAAU,MAAMjC,YAAYtB,IAAIC;IACtC,MAAMmC,cACJpC,IACAuD,QAAQvC,GAAG,CAAC,CAAC4B,SAAW,CAACL;YACvBA,MAAMN,MAAM,CAACP,cAAc1B,IAAI4C,OAAOnB,GAAG,EAAEG;QAC7C;AAEJ"}