@aglyn/tenant-feature-instance 1.0.0-beta.196 → 1.0.0-beta.198

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-feature-instance",
-  "version": "1.0.0-beta.196",
+  "version": "1.0.0-beta.198",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,11 +25,11 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.196",
-    "@aglyn/shared-data-enums": "1.0.0-beta.196",
-    "@aglyn/shared-ui-jsx": "1.0.0-beta.196",
-    "@aglyn/shared-util-http": "1.0.0-beta.196",
-    "@aglyn/shared-util-timestamp": "1.0.0-beta.196",
+    "@aglyn/aglyn": "1.0.0-beta.198",
+    "@aglyn/shared-data-enums": "1.0.0-beta.198",
+    "@aglyn/shared-ui-jsx": "1.0.0-beta.198",
+    "@aglyn/shared-util-http": "1.0.0-beta.198",
+    "@aglyn/shared-util-timestamp": "1.0.0-beta.198",
     "@swc/helpers": "0.5.23",
     "lodash-es": "^4.18.1"
   },

package/src/lib/hooks/use-scope-tokens.d.ts

@@ -23,6 +23,12 @@ export interface ScopeTokensState {
  * Defaults to org-wide while loading: the rules are the enforcement point,
  * and guessing "scoped" before the member doc arrives would flash an empty
  * library at people who can see everything.
+ *
+ * `loaded` answers for the member and org ASKED ABOUT NOW. A caller whose org
+ * id arrives after its first render — resolved from a site through the host
+ * index — would otherwise read the previous pass's answer, org-wide and
+ * loaded, while the member document it actually needs is still in flight,
+ * and send the one unfiltered query this hook exists to prevent.
  */
 export declare function useScopeTokens(orgId: string | undefined): ScopeTokensState;
 export default useScopeTokens;

package/src/lib/hooks/use-scope-tokens.js

@@ -17,7 +17,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * limitations under the License.
  */ import { isOrgWideMember, memberScopeTokens, ORG_SCOPE_TOKEN } from "@aglyn/aglyn";
 import { doc, getDoc } from "firebase/firestore";
-import { useEffect, useState } from "react";
+import { useEffect, useMemo, useState } from "react";
 import { useFirestore, useUser } from "./firebase/firebase-services.js";
 /**
  * The signed-in user's scope tokens in an org (AGL-1044/1045).
@@ -37,15 +37,24 @@ import { useFirestore, useUser } from "./firebase/firebase-services.js";
  * Defaults to org-wide while loading: the rules are the enforcement point,
  * and guessing "scoped" before the member doc arrives would flash an empty
  * library at people who can see everything.
+ *
+ * `loaded` answers for the member and org ASKED ABOUT NOW. A caller whose org
+ * id arrives after its first render — resolved from a site through the host
+ * index — would otherwise read the previous pass's answer, org-wide and
+ * loaded, while the member document it actually needs is still in flight,
+ * and send the one unfiltered query this hook exists to prevent.
  */ export function useScopeTokens(orgId) {
     const { data: user } = useUser();
     const firestore = useFirestore();
+    const signedIn = user == null ? void 0 : user.uid;
+    /** Whose reach the state holds: `uid/orgId`, or `null` for no org. */ const asked = signedIn && orgId ? `${signedIn}/${orgId}` : null;
     const [state, setState] = useState({
         tokens: [
             ORG_SCOPE_TOKEN
         ],
         orgWide: true,
-        loaded: false
+        loaded: false,
+        for: null
     });
     useEffect(()=>{
         const uid = user == null ? void 0 : user.uid;
@@ -55,10 +64,12 @@ import { useFirestore, useUser } from "./firebase/firebase-services.js";
                     ORG_SCOPE_TOKEN
                 ],
                 orgWide: true,
-                loaded: Boolean(uid)
+                loaded: Boolean(uid),
+                for: null
             });
             return;
         }
+        const key = `${uid}/${orgId}`;
         let cancelled = false;
         getDoc(doc(firestore, 'orgs', orgId, 'members', uid)).then((snapshot)=>{
             if (cancelled) return;
@@ -72,7 +83,8 @@ import { useFirestore, useUser } from "./firebase/firebase-services.js";
             setState({
                 tokens: memberScopeTokens(member),
                 orgWide: isOrgWideMember(member),
-                loaded: true
+                loaded: true,
+                for: key
             });
         }).catch(()=>{
             if (!cancelled) {
@@ -81,7 +93,8 @@ import { useFirestore, useUser } from "./firebase/firebase-services.js";
                         ORG_SCOPE_TOKEN
                     ],
                     orgWide: true,
-                    loaded: true
+                    loaded: true,
+                    for: key
                 });
             }
         });
@@ -93,7 +106,16 @@ import { useFirestore, useUser } from "./firebase/firebase-services.js";
         orgId,
         user
     ]);
-    return state;
+    const loaded = state.loaded && state.for === asked;
+    return useMemo(()=>({
+            tokens: state.tokens,
+            orgWide: state.orgWide,
+            loaded
+        }), [
+        state.tokens,
+        state.orgWide,
+        loaded
+    ]);
 }
 export default useScopeTokens;
 

package/src/lib/hooks/use-scope-tokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/feature/instance/src/lib/hooks/use-scope-tokens.ts"],"sourcesContent":["'use client'\n\n/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  isOrgWideMember,\n  memberScopeTokens,\n  ORG_SCOPE_TOKEN,\n  type AglynOrgMember,\n} from '@aglyn/aglyn'\nimport { doc, getDoc } from 'firebase/firestore'\nimport { useEffect, useState } from 'react'\nimport { useFirestore, useUser } from './firebase/firebase-services'\n\nexport interface ScopeTokensState {\n  /** The caller's read set, for `array-contains-any` (AGL-1037). */\n  tokens: string[]\n  /** Org-wide members read everything and need no query filter. */\n  orgWide: boolean\n  loaded: boolean\n}\n\n/**\n * The signed-in user's scope tokens in an org (AGL-1044/1045).\n *\n * This is NOT a UI-gating convenience — it is required for correctness.\n * Under AGL-1041/1042 the rules evaluate per document on a LIST, and\n * Firestore rejects the WHOLE query if any candidate would fail. So a\n * scoped collaborator's unfiltered `collection(...)` read comes back\n * `permission-denied`, not filtered: without the matching\n * `array-contains-any` constraint the page does not show less, it shows\n * an error.\n *\n * Org-wide members deliberately get `orgWide: true` and no filter. Adding\n * one would cost them a composite index for no benefit, and would silently\n * hide any doc whose `visibleTo` the backfill has not reached.\n *\n * Defaults to org-wide while loading: the rules are the enforcement point,\n * and guessing \"scoped\" before the member doc arrives would flash an empty\n * library at people who can see everything.\n */\nexport function useScopeTokens(orgId: string | undefined): ScopeTokensState {\n  const { data: user } = useUser()\n  const firestore = useFirestore()\n  const [state, setState] = useState<ScopeTokensState>({\n    tokens: [ORG_SCOPE_TOKEN],\n    orgWide: true,\n    loaded: false,\n  })\n\n  useEffect(() => {\n    const uid = (user as { uid?: string } | undefined)?.uid\n    if (!uid || !orgId) {\n      setState({ tokens: [ORG_SCOPE_TOKEN], orgWide: true, loaded: Boolean(uid) })\n      return\n    }\n    let cancelled = false\n    getDoc(doc(firestore, 'orgs', orgId, 'members', uid))\n      .then((snapshot) => {\n        if (cancelled) return\n        const member = snapshot.exists()\n          ? ({ $id: uid, ...snapshot.data() } as Partial<AglynOrgMember>)\n          : undefined\n        // `memberScopeTokens` owns the \"stored projection, else recompute\"\n        // rule so the client and every Admin-SDK gate answer it the same\n        // way — a member doc the AGL-1040 backfill has not reached must\n        // still resolve to what `grantHostAccess` would have stamped.\n        setState({\n          tokens: memberScopeTokens(member),\n          orgWide: isOrgWideMember(member),\n          loaded: true,\n        })\n      })\n      .catch(() => {\n        if (!cancelled) {\n          setState({ tokens: [ORG_SCOPE_TOKEN], orgWide: true, loaded: true })\n        }\n      })\n    return () => {\n      cancelled = true\n    }\n  }, [firestore, orgId, user])\n\n  return state\n}\n\nexport default useScopeTokens\n"],"names":["isOrgWideMember","memberScopeTokens","ORG_SCOPE_TOKEN","doc","getDoc","useEffect","useState","useFirestore","useUser","useScopeTokens","orgId","data","user","firestore","state","setState","tokens","orgWide","loaded","uid","Boolean","cancelled","then","snapshot","member","exists","$id","undefined","catch"],"mappings":"AAAA;;AAEA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,eAAe,EACfC,iBAAiB,EACjBC,eAAe,QAEV,eAAc;AACrB,SAASC,GAAG,EAAEC,MAAM,QAAQ,qBAAoB;AAChD,SAASC,SAAS,EAAEC,QAAQ,QAAQ,QAAO;AAC3C,SAASC,YAAY,EAAEC,OAAO,QAAQ,kCAA8B;AAUpE;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASC,eAAeC,KAAyB;IACtD,MAAM,EAAEC,MAAMC,IAAI,EAAE,GAAGJ;IACvB,MAAMK,YAAYN;IAClB,MAAM,CAACO,OAAOC,SAAS,GAAGT,SAA2B;QACnDU,QAAQ;YAACd;SAAgB;QACzBe,SAAS;QACTC,QAAQ;IACV;IAEAb,UAAU;QACR,MAAMc,MAAOP,wBAAD,AAACA,KAAuCO,GAAG;QACvD,IAAI,CAACA,OAAO,CAACT,OAAO;YAClBK,SAAS;gBAAEC,QAAQ;oBAACd;iBAAgB;gBAAEe,SAAS;gBAAMC,QAAQE,QAAQD;YAAK;YAC1E;QACF;QACA,IAAIE,YAAY;QAChBjB,OAAOD,IAAIU,WAAW,QAAQH,OAAO,WAAWS,MAC7CG,IAAI,CAAC,CAACC;YACL,IAAIF,WAAW;YACf,MAAMG,SAASD,SAASE,MAAM,KACzB;gBAAEC,KAAKP;eAAQI,SAASZ,IAAI,MAC7BgB;YACJ,mEAAmE;YACnE,iEAAiE;YACjE,gEAAgE;YAChE,8DAA8D;YAC9DZ,SAAS;gBACPC,QAAQf,kBAAkBuB;gBAC1BP,SAASjB,gBAAgBwB;gBACzBN,QAAQ;YACV;QACF,GACCU,KAAK,CAAC;YACL,IAAI,CAACP,WAAW;gBACdN,SAAS;oBAAEC,QAAQ;wBAACd;qBAAgB;oBAAEe,SAAS;oBAAMC,QAAQ;gBAAK;YACpE;QACF;QACF,OAAO;YACLG,YAAY;QACd;IACF,GAAG;QAACR;QAAWH;QAAOE;KAAK;IAE3B,OAAOE;AACT;AAEA,eAAeL,eAAc"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/feature/instance/src/lib/hooks/use-scope-tokens.ts"],"sourcesContent":["'use client'\n\n/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  isOrgWideMember,\n  memberScopeTokens,\n  ORG_SCOPE_TOKEN,\n  type AglynOrgMember,\n} from '@aglyn/aglyn'\nimport { doc, getDoc } from 'firebase/firestore'\nimport { useEffect, useMemo, useState } from 'react'\nimport { useFirestore, useUser } from './firebase/firebase-services'\n\nexport interface ScopeTokensState {\n  /** The caller's read set, for `array-contains-any` (AGL-1037). */\n  tokens: string[]\n  /** Org-wide members read everything and need no query filter. */\n  orgWide: boolean\n  loaded: boolean\n}\n\n/**\n * The signed-in user's scope tokens in an org (AGL-1044/1045).\n *\n * This is NOT a UI-gating convenience — it is required for correctness.\n * Under AGL-1041/1042 the rules evaluate per document on a LIST, and\n * Firestore rejects the WHOLE query if any candidate would fail. So a\n * scoped collaborator's unfiltered `collection(...)` read comes back\n * `permission-denied`, not filtered: without the matching\n * `array-contains-any` constraint the page does not show less, it shows\n * an error.\n *\n * Org-wide members deliberately get `orgWide: true` and no filter. Adding\n * one would cost them a composite index for no benefit, and would silently\n * hide any doc whose `visibleTo` the backfill has not reached.\n *\n * Defaults to org-wide while loading: the rules are the enforcement point,\n * and guessing \"scoped\" before the member doc arrives would flash an empty\n * library at people who can see everything.\n *\n * `loaded` answers for the member and org ASKED ABOUT NOW. A caller whose org\n * id arrives after its first render — resolved from a site through the host\n * index — would otherwise read the previous pass's answer, org-wide and\n * loaded, while the member document it actually needs is still in flight,\n * and send the one unfiltered query this hook exists to prevent.\n */\nexport function useScopeTokens(orgId: string | undefined): ScopeTokensState {\n  const { data: user } = useUser()\n  const firestore = useFirestore()\n  const signedIn = (user as { uid?: string } | undefined)?.uid\n  /** Whose reach the state holds: `uid/orgId`, or `null` for no org. */\n  const asked = signedIn && orgId ? `${signedIn}/${orgId}` : null\n  const [state, setState] = useState<ScopeTokensState & { for: string | null }>({\n    tokens: [ORG_SCOPE_TOKEN],\n    orgWide: true,\n    loaded: false,\n    for: null,\n  })\n\n  useEffect(() => {\n    const uid = (user as { uid?: string } | undefined)?.uid\n    if (!uid || !orgId) {\n      setState({\n        tokens: [ORG_SCOPE_TOKEN],\n        orgWide: true,\n        loaded: Boolean(uid),\n        for: null,\n      })\n      return\n    }\n    const key = `${uid}/${orgId}`\n    let cancelled = false\n    getDoc(doc(firestore, 'orgs', orgId, 'members', uid))\n      .then((snapshot) => {\n        if (cancelled) return\n        const member = snapshot.exists()\n          ? ({ $id: uid, ...snapshot.data() } as Partial<AglynOrgMember>)\n          : undefined\n        // `memberScopeTokens` owns the \"stored projection, else recompute\"\n        // rule so the client and every Admin-SDK gate answer it the same\n        // way — a member doc the AGL-1040 backfill has not reached must\n        // still resolve to what `grantHostAccess` would have stamped.\n        setState({\n          tokens: memberScopeTokens(member),\n          orgWide: isOrgWideMember(member),\n          loaded: true,\n          for: key,\n        })\n      })\n      .catch(() => {\n        if (!cancelled) {\n          setState({\n            tokens: [ORG_SCOPE_TOKEN],\n            orgWide: true,\n            loaded: true,\n            for: key,\n          })\n        }\n      })\n    return () => {\n      cancelled = true\n    }\n  }, [firestore, orgId, user])\n\n  const loaded = state.loaded && state.for === asked\n  return useMemo(\n    () => ({ tokens: state.tokens, orgWide: state.orgWide, loaded }),\n    [state.tokens, state.orgWide, loaded],\n  )\n}\n\nexport default useScopeTokens\n"],"names":["isOrgWideMember","memberScopeTokens","ORG_SCOPE_TOKEN","doc","getDoc","useEffect","useMemo","useState","useFirestore","useUser","useScopeTokens","orgId","data","user","firestore","signedIn","uid","asked","state","setState","tokens","orgWide","loaded","for","Boolean","key","cancelled","then","snapshot","member","exists","$id","undefined","catch"],"mappings":"AAAA;;AAEA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,eAAe,EACfC,iBAAiB,EACjBC,eAAe,QAEV,eAAc;AACrB,SAASC,GAAG,EAAEC,MAAM,QAAQ,qBAAoB;AAChD,SAASC,SAAS,EAAEC,OAAO,EAAEC,QAAQ,QAAQ,QAAO;AACpD,SAASC,YAAY,EAAEC,OAAO,QAAQ,kCAA8B;AAUpE;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,OAAO,SAASC,eAAeC,KAAyB;IACtD,MAAM,EAAEC,MAAMC,IAAI,EAAE,GAAGJ;IACvB,MAAMK,YAAYN;IAClB,MAAMO,WAAYF,wBAAD,AAACA,KAAuCG,GAAG;IAC5D,oEAAoE,GACpE,MAAMC,QAAQF,YAAYJ,QAAQ,GAAGI,SAAS,CAAC,EAAEJ,OAAO,GAAG;IAC3D,MAAM,CAACO,OAAOC,SAAS,GAAGZ,SAAoD;QAC5Ea,QAAQ;YAAClB;SAAgB;QACzBmB,SAAS;QACTC,QAAQ;QACRC,KAAK;IACP;IAEAlB,UAAU;QACR,MAAMW,MAAOH,wBAAD,AAACA,KAAuCG,GAAG;QACvD,IAAI,CAACA,OAAO,CAACL,OAAO;YAClBQ,SAAS;gBACPC,QAAQ;oBAAClB;iBAAgB;gBACzBmB,SAAS;gBACTC,QAAQE,QAAQR;gBAChBO,KAAK;YACP;YACA;QACF;QACA,MAAME,MAAM,GAAGT,IAAI,CAAC,EAAEL,OAAO;QAC7B,IAAIe,YAAY;QAChBtB,OAAOD,IAAIW,WAAW,QAAQH,OAAO,WAAWK,MAC7CW,IAAI,CAAC,CAACC;YACL,IAAIF,WAAW;YACf,MAAMG,SAASD,SAASE,MAAM,KACzB;gBAAEC,KAAKf;eAAQY,SAAShB,IAAI,MAC7BoB;YACJ,mEAAmE;YACnE,iEAAiE;YACjE,gEAAgE;YAChE,8DAA8D;YAC9Db,SAAS;gBACPC,QAAQnB,kBAAkB4B;gBAC1BR,SAASrB,gBAAgB6B;gBACzBP,QAAQ;gBACRC,KAAKE;YACP;QACF,GACCQ,KAAK,CAAC;YACL,IAAI,CAACP,WAAW;gBACdP,SAAS;oBACPC,QAAQ;wBAAClB;qBAAgB;oBACzBmB,SAAS;oBACTC,QAAQ;oBACRC,KAAKE;gBACP;YACF;QACF;QACF,OAAO;YACLC,YAAY;QACd;IACF,GAAG;QAACZ;QAAWH;QAAOE;KAAK;IAE3B,MAAMS,SAASJ,MAAMI,MAAM,IAAIJ,MAAMK,GAAG,KAAKN;IAC7C,OAAOX,QACL,IAAO,CAAA;YAAEc,QAAQF,MAAME,MAAM;YAAEC,SAASH,MAAMG,OAAO;YAAEC;QAAO,CAAA,GAC9D;QAACJ,MAAME,MAAM;QAAEF,MAAMG,OAAO;QAAEC;KAAO;AAEzC;AAEA,eAAeZ,eAAc"}