@antelopejs/interface-dms 0.7.4 → 0.9.0

package/dist/permissions-resolver.d.ts

@@ -1,5 +1,27 @@
 import { RegisteringProxy } from "@antelopejs/interface-core";
-export type PermissionsResolverFn = (userId: string, tenantId: string, currentPermissions: Set<string>) => Promise<Set<string>> | Set<string>;
+/**
+ * A role preview a resolver call computes the set for (Settings › Roles ›
+ * Preview as role), instead of a real member's.
+ */
+export interface PermissionsResolverPreview {
+    /** The previewed role's permissions, before any resolver reshaped them. */
+    rolePermissions: ReadonlySet<string>;
+}
+/** What a resolver call is for, besides the user and the tenant. */
+export interface PermissionsResolverContext {
+    /**
+     * Set when the call previews a role. `userId` is then the viewer's, but the
+     * set is the previewed role's: a resolver keyed on the user (an owner
+     * handed more, a screen kept for owners) must shape it as for an ordinary
+     * member holding only that role, never from the viewer's own standing.
+     */
+    preview?: PermissionsResolverPreview;
+}
+/**
+ * Reshape a user's permission set for a tenant. `context` says what the set is
+ * computed for: always passed, `{}` for a real member.
+ */
+export type PermissionsResolverFn = (userId: string, tenantId: string, currentPermissions: Set<string>, context: PermissionsResolverContext) => Promise<Set<string>> | Set<string>;
 export interface PermissionsResolverInfo {
     id: string;
     resolver: PermissionsResolverFn;
@@ -31,6 +53,7 @@ export declare function RegisterPermissionsResolver(info: PermissionsResolverInf
 /**
  * Run the registered resolvers over a base permission set and return the
  * effective set. Prefer `GetEffectiveUserPermissions` from `dms/permissions`,
- * which composes the base set computation with this pipeline.
+ * which composes the base set computation with this pipeline. `context` is
+ * handed to every resolver as is.
  */
-export declare const ApplyPermissionsResolvers: (userId: string, tenantId: string, basePermissions: Set<string>) => Promise<Set<string>>;
+export declare const ApplyPermissionsResolvers: (userId: string, tenantId: string, basePermissions: Set<string>, context: PermissionsResolverContext) => Promise<Set<string>>;

package/dist/permissions-resolver.js

@@ -32,7 +32,8 @@ function RegisterPermissionsResolver(info) {
 /**
  * Run the registered resolvers over a base permission set and return the
  * effective set. Prefer `GetEffectiveUserPermissions` from `dms/permissions`,
- * which composes the base set computation with this pipeline.
+ * which composes the base set computation with this pipeline. `context` is
+ * handed to every resolver as is.
  */
 exports.ApplyPermissionsResolvers = (0, interface_core_1.InterfaceFunction)();
 //# sourceMappingURL=permissions-resolver.js.map

package/dist/permissions-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-resolver.js","sourceRoot":"","sources":["../src/permissions-resolver.ts"],"names":[],"mappings":";;;AA0CA,kEAIC;AA9CD,+DAGoC;AAcpC,gBAAgB;AAChB,IAAiB,QAAQ,CAIxB;AAJD,WAAiB,QAAQ;IACV,oCAA2B,GAAG,IAAI,iCAAgB,EAE5D,CAAC;AACN,CAAC,EAJgB,QAAQ,wBAAR,QAAQ,QAIxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,2BAA2B,CACzC,IAA6B;IAE7B,QAAQ,CAAC,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACU,QAAA,yBAAyB,GACpC,IAAA,kCAAiB,GAMd,CAAC"}
+{"version":3,"file":"permissions-resolver.js","sourceRoot":"","sources":["../src/permissions-resolver.ts"],"names":[],"mappings":";;;AAmEA,kEAIC;AAvED,+DAGoC;AAuCpC,gBAAgB;AAChB,IAAiB,QAAQ,CAIxB;AAJD,WAAiB,QAAQ;IACV,oCAA2B,GAAG,IAAI,iCAAgB,EAE5D,CAAC;AACN,CAAC,EAJgB,QAAQ,wBAAR,QAAQ,QAIxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,2BAA2B,CACzC,IAA6B;IAE7B,QAAQ,CAAC,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACU,QAAA,yBAAyB,GACpC,IAAA,kCAAiB,GAOd,CAAC"}

package/dist/permissions.d.ts

@@ -1,5 +1,6 @@
 import { RegisteringProxy } from "@antelopejs/interface-core";
 import type { RoleModel } from "./db";
+import { type PermissionsResolverContext } from "./permissions-resolver";
 export interface Permission {
     id: string;
     title: string;
@@ -54,17 +55,20 @@ export declare function GetUserPermissions(user: {
  * (`ApplyPermissionsResolvers`): the dms module wires it in `construct()`.
  * In standalone contexts (unit tests, thin consumers) connect it manually
  * with `ImplementInterface`, otherwise the call queues until wired.
+ *
+ * `context` is handed to the resolvers: `{}` for the user's own set, `preview`
+ * when the set is a role previewed by that user.
  */
 export declare function GetEffectiveUserPermissions(user: {
     _id: string;
     owner?: boolean;
-}, tenantId: string, roleIds: string[], roleModel: RoleModel): Promise<Set<string>>;
+}, tenantId: string, roleIds: string[], roleModel: RoleModel, context?: PermissionsResolverContext): Promise<Set<string>>;
 /**
  * Whether `permissions` grants `permissionId`: on the `*` wildcard, on a
  * `defaultGranted` permission, or on a direct grant whose ancestors (the ids
  * it sits under) and `dependencies` are held too — a table's delete action
- * grants nothing without its table and its page, its edit nothing without
- * the view that loads the row.
+ * grants nothing without its table, its page and its list, its edit nothing
+ * without the view that loads the row.
  */
 export declare function HasPermission(permissions: Set<string>, permissionId: string): Promise<boolean>;
 /** Whether `permissions` grants at least one of `permissionIds`. */

package/dist/permissions.js

@@ -76,17 +76,20 @@ async function GetUserPermissions(user, roleIds, roleModel) {
  * (`ApplyPermissionsResolvers`): the dms module wires it in `construct()`.
  * In standalone contexts (unit tests, thin consumers) connect it manually
  * with `ImplementInterface`, otherwise the call queues until wired.
+ *
+ * `context` is handed to the resolvers: `{}` for the user's own set, `preview`
+ * when the set is a role previewed by that user.
  */
-async function GetEffectiveUserPermissions(user, tenantId, roleIds, roleModel) {
+async function GetEffectiveUserPermissions(user, tenantId, roleIds, roleModel, context = {}) {
     const basePermissions = await GetUserPermissions(user, roleIds, roleModel);
-    return (0, permissions_resolver_1.ApplyPermissionsResolvers)(user._id, tenantId, basePermissions);
+    return (0, permissions_resolver_1.ApplyPermissionsResolvers)(user._id, tenantId, basePermissions, context);
 }
 /**
  * Whether `permissions` grants `permissionId`: on the `*` wildcard, on a
  * `defaultGranted` permission, or on a direct grant whose ancestors (the ids
  * it sits under) and `dependencies` are held too — a table's delete action
- * grants nothing without its table and its page, its edit nothing without
- * the view that loads the row.
+ * grants nothing without its table, its page and its list, its edit nothing
+ * without the view that loads the row.
  */
 async function HasPermission(permissions, permissionId) {
     return grantsPermission(permissions, permissionId, new Set());
@@ -111,8 +114,7 @@ async function grantsPermission(permissions, permissionId, checked) {
     return ((await holdsAncestors(permissions, permissionId)) &&
         holdsDependencies(permissions, permission, checked));
 }
-// The role routes store a grant with every id it sits under, but a role saved
-// before they did, or a set a resolver reshaped, may lack some. An ancestor
+// The role routes store a grant with every id it sits under. An ancestor
 // counts as held when granted, `defaultGranted`, or not a registered
 // permission at all (a page declaring `permission: { id: "mailing.access" }`
 // has no `mailing` above it).

package/dist/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":";;;AAuDA,gEAEC;AAED,oEAEC;AAED,4DAIC;AAaD,gDAaC;AAcD,kEAQC;AASD,sCAKC;AA4DD,4CAQC;AArMD,+DAGoC;AAEpC,8DAAkE;AAClE,iEAAmE;AAoBnE;;GAEG;AACH,IAAiB,QAAQ,CAIxB;AAJD,WAAiB,QAAQ;IACV,2BAAkB,GAAG,IAAI,iCAAgB,EAEnD,CAAC;AACN,CAAC,EAJgB,QAAQ,wBAAR,QAAQ,QAIxB;AAEM,MAAM,kBAAkB,GAAG,CAAC,EAAU,EAAE,UAAsB,EAAE,EAAE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;AACvD,CAAC,CAAC;AAFW,QAAA,kBAAkB,sBAE7B;AAEF;;;GAGG;AACI,MAAM,oBAAoB,GAAG,CAAC,EAAU,EAAE,EAAE;IACjD,QAAQ,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC;AAFW,QAAA,oBAAoB,wBAE/B;AAEF,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,sCAAsC;AACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAU,CAAC;AAEpD,SAAgB,0BAA0B,CAAC,EAAU;IACnD,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAgB,4BAA4B,CAAC,EAAU;IACrD,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAgB,wBAAwB,CAAC,EAAU;IACjD,OAAO,CAAC,EAAE,EAAE,GAAG,IAAA,sCAAqB,EAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3D,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,CACzC,CAAC;AACJ,CAAC;AACY,QAAA,aAAa,GACxB,IAAA,kCAAiB,GAA0C,CAAC;AACjD,QAAA,cAAc,GACzB,IAAA,kCAAiB,GAAwC,CAAC;AAE5D;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAAyB,EACzB,OAAiB,EACjB,SAAoB;IAEpB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC;IACvD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,2BAA2B,CAC/C,IAAsC,EACtC,QAAgB,EAChB,OAAiB,EACjB,SAAoB;IAEpB,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3E,OAAO,IAAA,gDAAyB,EAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,aAAa,CACjC,WAAwB,EACxB,YAAoB;IAEpB,OAAO,gBAAgB,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,0EAA0E;AAC1E,gEAAgE;AAChE,KAAK,UAAU,gBAAgB,CAC7B,WAAwB,EACxB,YAAoB,EACpB,OAAoB;IAEpB,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,wBAAwB,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,YAAY,CAAC,CAAC;IACrD,IAAI,UAAU,EAAE,cAAc;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,CACL,CAAC,MAAM,cAAc,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACjD,iBAAiB,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,qEAAqE;AACrE,6EAA6E;AAC7E,8BAA8B;AAC9B,KAAK,UAAU,cAAc,CAC3B,WAAwB,EACxB,YAAoB;IAEpB,KAAK,MAAM,UAAU,IAAI,IAAA,sCAAqB,EAAC,YAAY,CAAC,EAAE,CAAC;QAC7D,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,UAAU,CAAC,CAAC;QACjD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,yEAAyE;AACzE,KAAK,UAAU,iBAAiB,CAC9B,WAAwB,EACxB,UAAkC,EAClC,OAAoB;IAEpB,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,YAAY,CAAC,CAAC;YAAE,SAAS;QACnD,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,gBAAgB,CACpC,WAAwB,EACxB,aAAuB;IAEvB,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,MAAM,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":";;;AA0DA,gEAEC;AAED,oEAEC;AAED,4DAIC;AAaD,gDAaC;AAiBD,kEAcC;AASD,sCAKC;AA2DD,4CAQC;AAhND,+DAGoC;AAEpC,8DAAkE;AAClE,iEAGgC;AAoBhC;;GAEG;AACH,IAAiB,QAAQ,CAIxB;AAJD,WAAiB,QAAQ;IACV,2BAAkB,GAAG,IAAI,iCAAgB,EAEnD,CAAC;AACN,CAAC,EAJgB,QAAQ,wBAAR,QAAQ,QAIxB;AAEM,MAAM,kBAAkB,GAAG,CAAC,EAAU,EAAE,UAAsB,EAAE,EAAE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;AACvD,CAAC,CAAC;AAFW,QAAA,kBAAkB,sBAE7B;AAEF;;;GAGG;AACI,MAAM,oBAAoB,GAAG,CAAC,EAAU,EAAE,EAAE;IACjD,QAAQ,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC;AAFW,QAAA,oBAAoB,wBAE/B;AAEF,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,sCAAsC;AACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAU,CAAC;AAEpD,SAAgB,0BAA0B,CAAC,EAAU;IACnD,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAgB,4BAA4B,CAAC,EAAU;IACrD,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAgB,wBAAwB,CAAC,EAAU;IACjD,OAAO,CAAC,EAAE,EAAE,GAAG,IAAA,sCAAqB,EAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3D,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,CACzC,CAAC;AACJ,CAAC;AACY,QAAA,aAAa,GACxB,IAAA,kCAAiB,GAA0C,CAAC;AACjD,QAAA,cAAc,GACzB,IAAA,kCAAiB,GAAwC,CAAC;AAE5D;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAAyB,EACzB,OAAiB,EACjB,SAAoB;IAEpB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC;IACvD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,2BAA2B,CAC/C,IAAsC,EACtC,QAAgB,EAChB,OAAiB,EACjB,SAAoB,EACpB,UAAsC,EAAE;IAExC,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3E,OAAO,IAAA,gDAAyB,EAC9B,IAAI,CAAC,GAAG,EACR,QAAQ,EACR,eAAe,EACf,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,aAAa,CACjC,WAAwB,EACxB,YAAoB;IAEpB,OAAO,gBAAgB,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,0EAA0E;AAC1E,gEAAgE;AAChE,KAAK,UAAU,gBAAgB,CAC7B,WAAwB,EACxB,YAAoB,EACpB,OAAoB;IAEpB,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,wBAAwB,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,YAAY,CAAC,CAAC;IACrD,IAAI,UAAU,EAAE,cAAc;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,CACL,CAAC,MAAM,cAAc,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACjD,iBAAiB,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,qEAAqE;AACrE,6EAA6E;AAC7E,8BAA8B;AAC9B,KAAK,UAAU,cAAc,CAC3B,WAAwB,EACxB,YAAoB;IAEpB,KAAK,MAAM,UAAU,IAAI,IAAA,sCAAqB,EAAC,YAAY,CAAC,EAAE,CAAC;QAC7D,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,UAAU,CAAC,CAAC;QACjD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,yEAAyE;AACzE,KAAK,UAAU,iBAAiB,CAC9B,WAAwB,EACxB,UAAkC,EAClC,OAAoB;IAEpB,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,YAAY,CAAC,CAAC;YAAE,SAAS;QACnD,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,gBAAgB,CACpC,WAAwB,EACxB,aAAuB;IAEvB,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,MAAM,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/realtime.d.ts

@@ -2,6 +2,17 @@ import { RegisteringProxy } from "@antelopejs/interface-core";
 export interface PublishMessageOptions {
     payload?: Record<string, unknown>;
     actorId?: string;
+    /**
+     * The tenant (workspace) the message is about. A message published with it
+     * reaches only the page sessions of that tenant; without it, the message is
+     * global and reaches every session subscribed to the topic, whatever their
+     * tenant.
+     *
+     * Pass it whenever the topic carries one workspace's data — a row changed, a
+     * send finished, a run completed — so the other workspaces' pages neither
+     * refetch nor count the message as missed.
+     */
+    tenantId?: string;
 }
 /** One message delivered to a {@link SubscribeMessage} handler. */
 export interface RealtimeMessage {
@@ -9,6 +20,12 @@ export interface RealtimeMessage {
     type: string;
     payload?: Record<string, unknown>;
     actorId?: string;
+    /**
+     * The tenant the message was published for, absent on a global message. A
+     * {@link SubscribeMessage} handler receives the messages of every tenant
+     * and filters on this field itself when it serves one.
+     */
+    tenantId?: string;
     ts: number;
 }
 export type RealtimeMessageHandler = (message: RealtimeMessage) => void;
@@ -29,9 +46,15 @@ export declare namespace internal {
  * module is unloaded, and it outlives a reload of the DMS module.
  */
 export declare const RegisterPageTopic: (pageId: string, topic: string) => void;
+/**
+ * Publish a message on `topic`. The page sessions bound to the topic refetch
+ * on it; with `options.tenantId` only those of that tenant do, without it the
+ * message is global.
+ */
 export declare const PublishMessage: (topic: string, type: string, options?: PublishMessageOptions | undefined) => Promise<void>;
 /**
- * Receive every message published on `topic`, whichever instance published it:
+ * Receive every message published on `topic`, whichever instance published it
+ * and whichever tenant it names (see {@link RealtimeMessage.tenantId}):
  * the subscription rides the same broker as {@link PublishMessage}, so what one
  * instance publishes reaches the subscribers of every other.
  *

package/dist/realtime.js

@@ -29,9 +29,15 @@ const RegisterPageTopic = (pageId, topic) => {
     internal.RegisterPageTopic.register(pageTopicId(pageId, topic), pageId, topic);
 };
 exports.RegisterPageTopic = RegisterPageTopic;
+/**
+ * Publish a message on `topic`. The page sessions bound to the topic refetch
+ * on it; with `options.tenantId` only those of that tenant do, without it the
+ * message is global.
+ */
 exports.PublishMessage = (0, interface_core_1.InterfaceFunction)();
 /**
- * Receive every message published on `topic`, whichever instance published it:
+ * Receive every message published on `topic`, whichever instance published it
+ * and whichever tenant it names (see {@link RealtimeMessage.tenantId}):
  * the subscription rides the same broker as {@link PublishMessage}, so what one
  * instance publishes reaches the subscribers of every other.
  *

package/dist/realtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"realtime.js","sourceRoot":"","sources":["../src/realtime.ts"],"names":[],"mappings":";;;AAsFA,4CAOC;AA7FD,6CAAyC;AACzC,+DAGoC;AAqBpC;;GAEG;AACH,IAAiB,QAAQ,CAQxB;AARD,WAAiB,QAAQ;IACV,0BAAiB,GAAG,IAAI,iCAAgB,EAElD,CAAC;IAES,yBAAgB,GAAG,IAAI,iCAAgB,EAEjD,CAAC;AACN,CAAC,EARgB,QAAQ,wBAAR,QAAQ,QAQxB;AAED,+EAA+E;AAC/E,2EAA2E;AAC3E,0CAA0C;AAC1C,SAAS,WAAW,CAAC,MAAc,EAAE,KAAa;IAChD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACI,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,KAAa,EAAQ,EAAE;IACvE,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CACjC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAC1B,MAAM,EACN,KAAK,CACN,CAAC;AACJ,CAAC,CAAC;AANW,QAAA,iBAAiB,qBAM5B;AAEW,QAAA,cAAc,GACzB,IAAA,kCAAiB,GAMd,CAAC;AAEN;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,gBAAgB,CAC9B,KAAa,EACb,OAA+B;IAE/B,MAAM,EAAE,GAAG,IAAA,wBAAU,GAAE,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"realtime.js","sourceRoot":"","sources":["../src/realtime.ts"],"names":[],"mappings":";;;AA6GA,4CAOC;AApHD,6CAAyC;AACzC,+DAGoC;AAsCpC;;GAEG;AACH,IAAiB,QAAQ,CAQxB;AARD,WAAiB,QAAQ;IACV,0BAAiB,GAAG,IAAI,iCAAgB,EAElD,CAAC;IAES,yBAAgB,GAAG,IAAI,iCAAgB,EAEjD,CAAC;AACN,CAAC,EARgB,QAAQ,wBAAR,QAAQ,QAQxB;AAED,+EAA+E;AAC/E,2EAA2E;AAC3E,0CAA0C;AAC1C,SAAS,WAAW,CAAC,MAAc,EAAE,KAAa;IAChD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACI,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,KAAa,EAAQ,EAAE;IACvE,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CACjC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAC1B,MAAM,EACN,KAAK,CACN,CAAC;AACJ,CAAC,CAAC;AANW,QAAA,iBAAiB,qBAM5B;AAEF;;;;GAIG;AACU,QAAA,cAAc,GACzB,IAAA,kCAAiB,GAMd,CAAC;AAEN;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,gBAAgB,CAC9B,KAAa,EACb,OAA+B;IAE/B,MAAM,EAAE,GAAG,IAAA,wBAAU,GAAE,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/request-tenant.d.ts

@@ -1,19 +1,23 @@
 import type { RequestContext } from "@antelopejs/interface-api";
 /**
- * Prefer the tenant bound by authenticateRequestPrincipal or the tenant guards.
- * An authentication failure or changed credential makes this accessor throw.
- * Without a bound principal, preserve legacy JWT decoding / DEFAULT_TENANT_ID.
+ * The tenant of the request's verified credential: the one bound by the DMS
+ * auth decorators (`AuthUser`, `AuthUserWithPermission`, `IfAuthUser` with a
+ * valid token…), the tenant guards or `authenticateRequestPrincipal`.
+ * Without a verified credential, `DEFAULT_TENANT_ID`: a token is never read
+ * for its tenant before its signature, user and session are checked.
  *
- * The legacy value is only *decoded*: this function does NOT verify the
- * JWT signature. It is safe when the request has already been authenticated
- * upstream (auth decorators such as `@AuthUser`, `@AuthTenantMember`, or the
- * gating performed by `PageController`) — those validators verify the signature
- * before this function runs, so the decoded `tenantId` is authentic.
+ * Call it once the route's auth decorator has run (in the handler). A
+ * parameter or property provider resolved alongside the auth decorator uses
+ * {@link resolveRequestTenantId} instead.
  *
- * For routes that legitimately accept anonymous traffic (e.g. `@IfAuthUser`),
- * the fallback resolves to `DEFAULT_TENANT_ID` so public layouts can be served.
- *
- * Do NOT introduce new routes that rely on `tenantId` for authorization without
- * upstream auth verification — without signature checks, the claim is forgeable.
+ * @throws HTTPResult 401 when the request's authentication failed or its
+ * credential changed since
  */
 export declare function getRequestTenantId(ctx: RequestContext): string;
+/**
+ * {@link getRequestTenantId} for a provider that may run before the route's
+ * auth decorator (`TenantScopedModel`, a tenant-scoped `Model`): a bearer
+ * token not yet verified is verified here, and its tenant bound to the
+ * request. An invalid token reads as anonymous: `DEFAULT_TENANT_ID`.
+ */
+export declare function resolveRequestTenantId(ctx: RequestContext): Promise<string>;

package/dist/request-tenant.js

@@ -1,58 +1,70 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRequestTenantId = getRequestTenantId;
-const jsonwebtoken_1 = require("jsonwebtoken");
+exports.resolveRequestTenantId = resolveRequestTenantId;
+const auth_1 = require("./auth");
 const request_authenticators_1 = require("./auth/internal/request-authenticators");
 const constants_1 = require("./constants");
-const BEARER_PREFIX = "Bearer ";
-function extractBearerToken(authHeader) {
-    if (typeof authHeader !== "string")
-        return undefined;
-    if (!authHeader.startsWith(BEARER_PREFIX))
-        return undefined;
-    return authHeader.slice(BEARER_PREFIX.length);
+const BEARER_SCHEME = /^Bearer\s+(\S+)$/i;
+const pendingResolutions = new WeakMap();
+/**
+ * The tenant of the request's verified credential: the one bound by the DMS
+ * auth decorators (`AuthUser`, `AuthUserWithPermission`, `IfAuthUser` with a
+ * valid token…), the tenant guards or `authenticateRequestPrincipal`.
+ * Without a verified credential, `DEFAULT_TENANT_ID`: a token is never read
+ * for its tenant before its signature, user and session are checked.
+ *
+ * Call it once the route's auth decorator has run (in the handler). A
+ * parameter or property provider resolved alongside the auth decorator uses
+ * {@link resolveRequestTenantId} instead.
+ *
+ * @throws HTTPResult 401 when the request's authentication failed or its
+ * credential changed since
+ */
+function getRequestTenantId(ctx) {
+    return (0, request_authenticators_1.getAuthenticatedRequestTenantId)(ctx) ?? constants_1.DEFAULT_TENANT_ID;
 }
-function readTenantIdFromToken(token) {
+async function verifyRequestTenantId(ctx, token) {
     try {
-        const payload = (0, jsonwebtoken_1.decode)(token);
-        if (payload &&
-            typeof payload.tenantId === "string" &&
-            payload.tenantId.length > 0) {
-            return payload.tenantId;
-        }
+        const data = await auth_1.internal.IfAuthUserAuthenticator(token);
+        if (!data)
+            return constants_1.DEFAULT_TENANT_ID;
+        const user = await auth_1.internal.AuthRawUserValidator(data);
+        if (!user || typeof user === "boolean")
+            return constants_1.DEFAULT_TENANT_ID;
+        const tenantId = data.tenantId || constants_1.DEFAULT_TENANT_ID;
+        (0, request_authenticators_1.bindVerifiedRequestPrincipal)(ctx, { userId: user._id, tenantId });
+        return tenantId;
     }
     catch {
-        return undefined;
+        return constants_1.DEFAULT_TENANT_ID;
     }
-    return undefined;
 }
 /**
- * Prefer the tenant bound by authenticateRequestPrincipal or the tenant guards.
- * An authentication failure or changed credential makes this accessor throw.
- * Without a bound principal, preserve legacy JWT decoding / DEFAULT_TENANT_ID.
- *
- * The legacy value is only *decoded*: this function does NOT verify the
- * JWT signature. It is safe when the request has already been authenticated
- * upstream (auth decorators such as `@AuthUser`, `@AuthTenantMember`, or the
- * gating performed by `PageController`) — those validators verify the signature
- * before this function runs, so the decoded `tenantId` is authentic.
- *
- * For routes that legitimately accept anonymous traffic (e.g. `@IfAuthUser`),
- * the fallback resolves to `DEFAULT_TENANT_ID` so public layouts can be served.
- *
- * Do NOT introduce new routes that rely on `tenantId` for authorization without
- * upstream auth verification — without signature checks, the claim is forgeable.
+ * {@link getRequestTenantId} for a provider that may run before the route's
+ * auth decorator (`TenantScopedModel`, a tenant-scoped `Model`): a bearer
+ * token not yet verified is verified here, and its tenant bound to the
+ * request. An invalid token reads as anonymous: `DEFAULT_TENANT_ID`.
  */
-function getRequestTenantId(ctx) {
-    const authenticatedTenantId = (0, request_authenticators_1.getAuthenticatedRequestTenantId)(ctx);
-    if (authenticatedTenantId)
-        return authenticatedTenantId;
-    const token = extractBearerToken(ctx.rawRequest?.headers?.authorization);
-    if (token) {
-        const tenantIdFromJwt = readTenantIdFromToken(token);
-        if (tenantIdFromJwt)
-            return tenantIdFromJwt;
+async function resolveRequestTenantId(ctx) {
+    const bound = (0, request_authenticators_1.getAuthenticatedRequestTenantId)(ctx);
+    if (bound)
+        return bound;
+    const header = ctx.rawRequest?.headers?.authorization;
+    const token = typeof header === "string" ? header.match(BEARER_SCHEME)?.[1] : undefined;
+    if (!token)
+        return constants_1.DEFAULT_TENANT_ID;
+    const request = ctx.rawRequest;
+    const pending = pendingResolutions.get(request);
+    if (pending)
+        return pending;
+    const resolution = verifyRequestTenantId(ctx, token);
+    pendingResolutions.set(request, resolution);
+    try {
+        return await resolution;
+    }
+    finally {
+        pendingResolutions.delete(request);
     }
-    return constants_1.DEFAULT_TENANT_ID;
 }
 //# sourceMappingURL=request-tenant.js.map

package/dist/request-tenant.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-tenant.js","sourceRoot":"","sources":["../src/request-tenant.ts"],"names":[],"mappings":";;AAkDA,gDASC;AA1DD,+CAAsC;AACtC,mFAAyF;AACzF,2CAAgD;AAEhD,MAAM,aAAa,GAAG,SAAS,CAAC;AAMhC,SAAS,kBAAkB,CAAC,UAAmB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,qBAAM,EAAC,KAAK,CAAgC,CAAC;QAC7D,IACE,OAAO;YACP,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;YACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAC3B,CAAC;YACD,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,kBAAkB,CAAC,GAAmB;IACpD,MAAM,qBAAqB,GAAG,IAAA,wDAA+B,EAAC,GAAG,CAAC,CAAC;IACnE,IAAI,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IACzE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,eAAe,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;IAC9C,CAAC;IACD,OAAO,6BAAiB,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"request-tenant.js","sourceRoot":"","sources":["../src/request-tenant.ts"],"names":[],"mappings":";;AA2BA,gDAEC;AAyBD,wDAmBC;AAvED,iCAAkC;AAClC,mFAGgD;AAChD,2CAAgD;AAEhD,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C,MAAM,kBAAkB,GAAG,IAAI,OAAO,EAAoC,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,SAAgB,kBAAkB,CAAC,GAAmB;IACpD,OAAO,IAAA,wDAA+B,EAAC,GAAG,CAAC,IAAI,6BAAiB,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAmB,EACnB,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI;YAAE,OAAO,6BAAiB,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,eAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,SAAS;YAAE,OAAO,6BAAiB,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,6BAAiB,CAAC;QACpD,IAAA,qDAA4B,EAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,6BAAiB,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,sBAAsB,CAC1C,GAAmB;IAEnB,MAAM,KAAK,GAAG,IAAA,wDAA+B,EAAC,GAAG,CAAC,CAAC;IACnD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC;IACtD,MAAM,KAAK,GACT,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,6BAAiB,CAAC;IACrC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC;IAC/B,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrD,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/tenant-members.d.ts

@@ -0,0 +1,26 @@
+import { type MemberChange } from "./hooks";
+/** What one membership or invitation write changes, and the write itself. */
+export interface TenantMembersWrite<T> {
+    /**
+     * Announced through `Hook.MEMBER_BEING_CHANGED`, in order, before `write`
+     * runs. Empty for a write that changes no membership, such as an invitation
+     * created, edited or retired.
+     */
+    changes: MemberChange[];
+    write: () => Promise<T>;
+}
+/**
+ * The one entry point for writing tenant members and invitations: every
+ * insert, update or delete of a `TenantMemberModel` or `UserInviteModel` row
+ * goes through it. It admits the write under the tenant's lifecycle (refused
+ * while a barrier is held or once the tenant is closed), calls `plan` to read
+ * the current state and describe the change, fires `Hook.MEMBER_BEING_CHANGED`
+ * for each change (a throwing handler refuses the write, replays included),
+ * then runs the write and releases the admission.
+ *
+ * `plan` runs inside the admission so the change it describes is read from
+ * state no paused initiator is validating. Never call this from inside
+ * another `changeTenantMembers` or `runTenantLifecycleOperation` callback:
+ * each call takes its own admission.
+ */
+export declare function changeTenantMembers<T>(tenantId: string, plan: () => Promise<TenantMembersWrite<T>>): Promise<T>;

package/dist/tenant-members.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.changeTenantMembers = changeTenantMembers;
+const hooks_1 = require("./hooks");
+const tenant_lifecycle_1 = require("./tenant-lifecycle");
+/**
+ * The one entry point for writing tenant members and invitations: every
+ * insert, update or delete of a `TenantMemberModel` or `UserInviteModel` row
+ * goes through it. It admits the write under the tenant's lifecycle (refused
+ * while a barrier is held or once the tenant is closed), calls `plan` to read
+ * the current state and describe the change, fires `Hook.MEMBER_BEING_CHANGED`
+ * for each change (a throwing handler refuses the write, replays included),
+ * then runs the write and releases the admission.
+ *
+ * `plan` runs inside the admission so the change it describes is read from
+ * state no paused initiator is validating. Never call this from inside
+ * another `changeTenantMembers` or `runTenantLifecycleOperation` callback:
+ * each call takes its own admission.
+ */
+async function changeTenantMembers(tenantId, plan) {
+    return (0, tenant_lifecycle_1.runTenantLifecycleOperation)(tenantId, async () => {
+        const { changes, write } = await plan();
+        for (const change of changes) {
+            await (0, hooks_1.ExecuteHooks)(hooks_1.Hook.MEMBER_BEING_CHANGED, { tenantId, ...change });
+        }
+        return write();
+    });
+}
+//# sourceMappingURL=tenant-members.js.map

package/dist/tenant-members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-members.js","sourceRoot":"","sources":["../src/tenant-members.ts"],"names":[],"mappings":";;AA4BA,kDAWC;AAvCD,mCAAgE;AAChE,yDAAiE;AAajE;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAA0C;IAE1C,OAAO,IAAA,8CAA2B,EAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;QACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tenant-ownership.d.ts

@@ -6,7 +6,10 @@ export interface TenantMembershipPatch {
     /** Durable invite delivery; grants membership without replacing later edits. */
     deliveryId?: string;
 }
-/** Admits membership writes before a tenant can begin destructive deletion. */
+/**
+ * Adds the user to the tenant, or sets the roles and ownership of an existing
+ * member, through `changeTenantMembers`.
+ */
 export declare function applyTenantOwnership(userModel: UserModel, userId: string, tenantId: string, patch: TenantMembershipPatch): Promise<void>;
 export declare function syncPlatformOwnerOnTenantOwnerChange(userModel: UserModel, userId: string, tenantId: string, nextIsTenantOwner: boolean): Promise<void>;
 export declare function clearPlatformOwnerOnMemberRemoval(userModel: UserModel, userId: string, tenantId: string, removedMemberWasTenantOwner: boolean): Promise<void>;

package/dist/tenant-ownership.js

@@ -5,25 +5,20 @@ exports.syncPlatformOwnerOnTenantOwnerChange = syncPlatformOwnerOnTenantOwnerCha
 exports.clearPlatformOwnerOnMemberRemoval = clearPlatformOwnerOnMemberRemoval;
 const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
 const tenantMembers_model_1 = require("./db/models/tenantMembers.model");
-const hooks_1 = require("./hooks");
-const tenant_lifecycle_1 = require("./tenant-lifecycle");
+const tenant_members_1 = require("./tenant-members");
+const member_changes_1 = require("./internal/member-changes");
 const tenant_ownership_1 = require("./internal/tenant-ownership");
-/** Admits membership writes before a tenant can begin destructive deletion. */
+/**
+ * Adds the user to the tenant, or sets the roles and ownership of an existing
+ * member, through `changeTenantMembers`.
+ */
 async function applyTenantOwnership(userModel, userId, tenantId, patch) {
-    await (0, tenant_lifecycle_1.runTenantLifecycleOperation)(tenantId, async () => {
-        // Public callers supplying a delivery identity still need the policy veto.
-        // Internal resolution checks it before persisting its applying phase.
-        if (patch.deliveryId &&
-            !(await (0, interface_database_decorators_1.GetModel)(tenantMembers_model_1.TenantMemberModel, tenantId).getByUser(userId))) {
-            await (0, hooks_1.ExecuteHooks)(hooks_1.Hook.MEMBER_BEING_CHANGED, {
-                tenantId,
-                userId,
-                isTenantOwner: patch.isTenantOwner,
-                previousIsTenantOwner: null,
-                deliveryId: patch.deliveryId,
-            });
-        }
-        await (0, tenant_ownership_1.applyAdmittedTenantOwnership)(userModel, userId, tenantId, patch);
+    await (0, tenant_members_1.changeTenantMembers)(tenantId, async () => {
+        const existing = await (0, interface_database_decorators_1.GetModel)(tenantMembers_model_1.TenantMemberModel, tenantId).getByUser(userId);
+        return {
+            changes: (0, member_changes_1.describeMembershipPatch)(existing, userId, patch),
+            write: () => (0, tenant_ownership_1.applyAdmittedTenantOwnership)(userModel, userId, tenantId, patch),
+        };
     });
 }
 async function syncPlatformOwnerOnTenantOwnerChange(userModel, userId, tenantId, nextIsTenantOwner) {

package/dist/tenant-ownership.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-ownership.js","sourceRoot":"","sources":["../src/tenant-ownership.ts"],"names":[],"mappings":";;AAmBA,oDAuBC;AAED,oFAOC;AAED,8EAQC;AA5DD,6FAAqE;AACrE,yEAAoE;AACpE,mCAA6C;AAC7C,yDAAiE;AACjE,kEAGqC;AAUrC,+EAA+E;AACxE,KAAK,UAAU,oBAAoB,CACxC,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,KAA4B;IAE5B,MAAM,IAAA,8CAA2B,EAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACrD,2EAA2E;QAC3E,sEAAsE;QACtE,IACE,KAAK,CAAC,UAAU;YAChB,CAAC,CAAC,MAAM,IAAA,wCAAQ,EAAC,uCAAiB,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAChE,CAAC;YACD,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,oBAAoB,EAAE;gBAC5C,QAAQ;gBACR,MAAM;gBACN,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,qBAAqB,EAAE,IAAI;gBAC3B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAA,+CAA4B,EAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,oCAAoC,CACxD,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,iBAA0B;IAE1B,MAAM,IAAA,sCAAmB,EAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;AAC5E,CAAC;AAEM,KAAK,UAAU,iCAAiC,CACrD,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,2BAAoC;IAEpC,IAAI,CAAC,2BAA2B;QAAE,OAAO;IACzC,MAAM,IAAA,sCAAmB,EAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"tenant-ownership.js","sourceRoot":"","sources":["../src/tenant-ownership.ts"],"names":[],"mappings":";;AAsBA,oDAgBC;AAED,oFAOC;AAED,8EAQC;AAxDD,6FAAqE;AACrE,yEAAoE;AACpE,qDAAuD;AACvD,8DAAoE;AACpE,kEAGqC;AAUrC;;;GAGG;AACI,KAAK,UAAU,oBAAoB,CACxC,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,KAA4B;IAE5B,MAAM,IAAA,oCAAmB,EAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,QAAQ,GAAG,MAAM,IAAA,wCAAQ,EAAC,uCAAiB,EAAE,QAAQ,CAAC,CAAC,SAAS,CACpE,MAAM,CACP,CAAC;QACF,OAAO;YACL,OAAO,EAAE,IAAA,wCAAuB,EAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC;YACzD,KAAK,EAAE,GAAG,EAAE,CACV,IAAA,+CAA4B,EAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;SACnE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,oCAAoC,CACxD,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,iBAA0B;IAE1B,MAAM,IAAA,sCAAmB,EAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;AAC5E,CAAC;AAEM,KAAK,UAAU,iCAAiC,CACrD,SAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,2BAAoC;IAEpC,IAAI,CAAC,2BAA2B;QAAE,OAAO;IACzC,MAAM,IAAA,sCAAmB,EAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/tenant-provisioning.d.ts

@@ -0,0 +1,15 @@
+import { type TenantProvisioningHookPayload } from "./hooks";
+/**
+ * Provision a tenant whose row was just created: register it as an instance
+ * of the tenant schema, then run the `Hook.TENANT_BEING_PROVISIONED`
+ * handlers in series. The instance is registered first, here rather than by a
+ * handler, so no handler ever runs before it, whatever order the modules
+ * registered in.
+ *
+ * Call it once per tenant, at its creation, and fire the hook through it
+ * only. A handler that throws rejects the call, and the caller unwinds the
+ * tenant it was creating.
+ *
+ * @param payload Tenant being provisioned and what the caller carries along
+ */
+export declare function ProvisionTenant(payload: TenantProvisioningHookPayload): Promise<void>;

package/dist/tenant-provisioning.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProvisionTenant = ProvisionTenant;
+const node_assert_1 = require("node:assert");
+const interface_database_1 = require("@antelopejs/interface-database");
+const constants_1 = require("./constants");
+const hooks_1 = require("./hooks");
+/**
+ * Provision a tenant whose row was just created: register it as an instance
+ * of the tenant schema, then run the `Hook.TENANT_BEING_PROVISIONED`
+ * handlers in series. The instance is registered first, here rather than by a
+ * handler, so no handler ever runs before it, whatever order the modules
+ * registered in.
+ *
+ * Call it once per tenant, at its creation, and fire the hook through it
+ * only. A handler that throws rejects the call, and the caller unwinds the
+ * tenant it was creating.
+ *
+ * @param payload Tenant being provisioned and what the caller carries along
+ */
+async function ProvisionTenant(payload) {
+    const schema = interface_database_1.Schema.get(constants_1.TENANT_SCHEMA_NAME);
+    (0, node_assert_1.strict)(schema, `Schema '${constants_1.TENANT_SCHEMA_NAME}' is not registered`);
+    await schema.createInstance(payload.tenantId);
+    await (0, hooks_1.ExecuteHooks)(hooks_1.Hook.TENANT_BEING_PROVISIONED, payload);
+}
+//# sourceMappingURL=tenant-provisioning.js.map

package/dist/tenant-provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-provisioning.js","sourceRoot":"","sources":["../src/tenant-provisioning.ts"],"names":[],"mappings":";;AAsBA,0CAOC;AA7BD,6CAA+C;AAC/C,uEAAwD;AACxD,2CAAiD;AACjD,mCAIiB;AAEjB;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,eAAe,CACnC,OAAsC;IAEtC,MAAM,MAAM,GAAG,2BAAM,CAAC,GAAG,CAAC,8BAAkB,CAAC,CAAC;IAC9C,IAAA,oBAAM,EAAC,MAAM,EAAE,WAAW,8BAAkB,qBAAqB,CAAC,CAAC;IACnE,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC"}

package/dist/tenant-scoped-model.d.ts

@@ -2,7 +2,8 @@ import { type Class } from "@antelopejs/interface-core/decorators";
 import { type DataModel } from "@antelopejs/interface-database-decorators";
 /**
  * Parameter/property decorator that injects `GetModel(cl, currentTenantId)`,
- * where `currentTenantId` is resolved per-request via {@link getRequestTenantId}.
+ * where `currentTenantId` is the tenant of the request's verified credential
+ * ({@link resolveRequestTenantId}), `DEFAULT_TENANT_ID` without one.
  *
  * Use on a `Model`-typed parameter of a route handler or DataAPI field. Only
  * applicable when the target table is registered in the `dms-tenant` schema

package/dist/tenant-scoped-model.js

@@ -7,15 +7,16 @@ const interface_database_decorators_1 = require("@antelopejs/interface-database-
 const request_tenant_1 = require("./request-tenant");
 /**
  * Parameter/property decorator that injects `GetModel(cl, currentTenantId)`,
- * where `currentTenantId` is resolved per-request via {@link getRequestTenantId}.
+ * where `currentTenantId` is the tenant of the request's verified credential
+ * ({@link resolveRequestTenantId}), `DEFAULT_TENANT_ID` without one.
  *
  * Use on a `Model`-typed parameter of a route handler or DataAPI field. Only
  * applicable when the target table is registered in the `dms-tenant` schema
  * (or any schema with one instance per tenant).
  */
 exports.TenantScopedModel = (0, decorators_1.MakeParameterAndPropertyDecorator)((target, key, index, cl) => {
-    (0, interface_api_1.SetParameterProvider)(target, key, index, (ctx) => {
-        return (0, interface_database_decorators_1.GetModel)(cl, (0, request_tenant_1.getRequestTenantId)(ctx));
+    (0, interface_api_1.SetParameterProvider)(target, key, index, async (ctx) => {
+        return (0, interface_database_decorators_1.GetModel)(cl, await (0, request_tenant_1.resolveRequestTenantId)(ctx));
     });
 });
 //# sourceMappingURL=tenant-scoped-model.js.map

package/dist/tenant-scoped-model.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scoped-model.js","sourceRoot":"","sources":["../src/tenant-scoped-model.ts"],"names":[],"mappings":";;;AAAA,6DAGmC;AACnC,sEAG+C;AAC/C,6FAGmD;AACnD,qDAAsD;AAEtD;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAG,IAAA,8CAAiC,EAChE,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,EAA8C,EAAE,EAAE;IACrE,IAAA,oCAAoB,EAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,GAAmB,EAAE,EAAE;QAC/D,OAAO,IAAA,wCAAQ,EAAC,EAAE,EAAE,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}
+{"version":3,"file":"tenant-scoped-model.js","sourceRoot":"","sources":["../src/tenant-scoped-model.ts"],"names":[],"mappings":";;;AAAA,6DAGmC;AACnC,sEAG+C;AAC/C,6FAGmD;AACnD,qDAA0D;AAE1D;;;;;;;;GAQG;AACU,QAAA,iBAAiB,GAAG,IAAA,8CAAiC,EAChE,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,EAA8C,EAAE,EAAE;IACrE,IAAA,oCAAoB,EAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAmB,EAAE,EAAE;QACrE,OAAO,IAAA,wCAAQ,EAAC,EAAE,EAAE,MAAM,IAAA,uCAAsB,EAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}