@auth-gate/core 0.12.1 → 0.13.0

package/dist/index.cjs

@@ -55,9 +55,11 @@ __export(index_exports, {
   hasAllPermissions: () => hasAllPermissions,
   hasAnyPermission: () => hasAnyPermission,
   hasFeature: () => hasFeature,
+  hasMergedPermission: () => hasMergedPermission,
   hasPermission: () => hasPermission,
   hasPlan: () => hasPlan,
-  hasRole: () => hasRole
+  hasRole: () => hasRole,
+  mergePermissions: () => mergePermissions
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -1323,3 +1325,18 @@ function matchesPermission(granted, required) {
   }
   return false;
 }
+function mergePermissions(projectRole, orgMembership) {
+  var _a;
+  const set = /* @__PURE__ */ new Set();
+  if (projectRole == null ? void 0 : projectRole.permissions) {
+    for (const p of projectRole.permissions) set.add(p);
+  }
+  if ((_a = orgMembership == null ? void 0 : orgMembership.role) == null ? void 0 : _a.permissions) {
+    for (const p of orgMembership.role.permissions) set.add(p);
+  }
+  return [...set];
+}
+function hasMergedPermission(projectRole, orgMembership, permission) {
+  const merged = mergePermissions(projectRole, orgMembership);
+  return matchesPermission(merged, permission);
+}

package/dist/index.d.cts

@@ -989,5 +989,22 @@ declare function hasAnyPermission(membership: OrgMembership | null | undefined,
  * @returns `true` if every permission is granted.
  */
 declare function hasAllPermissions(membership: OrgMembership | null | undefined, permissions: string[]): boolean;
+/** A user's project-level role assignment (no org required). */
+interface UserRoleAssignment {
+    roleKey: string;
+    roleName: string;
+    permissions: string[];
+    assignedAt: string;
+}
+/**
+ * Merge permissions from a project-level role and an org-level role (union).
+ * Either may be null/undefined.
+ */
+declare function mergePermissions(projectRole: UserRoleAssignment | null | undefined, orgMembership: OrgMembership | null | undefined): string[];
+/**
+ * Check a permission against a merged permission set (project + org).
+ * Supports wildcard matching.
+ */
+declare function hasMergedPermission(projectRole: UserRoleAssignment | null | undefined, orgMembership: OrgMembership | null | undefined, permission: string): boolean;
 
-export { AuthGateClient, type AuthGateConfig, type AuthGateConnection, AuthGateError, type AuthGateProjectConfig, type AuthGateUser, type BackupCodesResponse, type BillingEntitlement, type BillingEntitlementV2, type BillingPlan, type BillingPrice, type BillingSubscription, type BillingSubscriptionItem, type BooleanEntitlementDetail, ConfigurationError, type CookieOptions, DEFAULT_COOKIE_NAME, type EntitlementDetail, InvalidStateError, type MeteredEntitlementDetail, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, type OrgInvitation, type OrgMember, type OrgMembership, type OrgRole, type OrgWithMembership, type Organization, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, type UsageEvent, checkFeature, createAuthGateClient, defineConfig, hasAllPermissions, hasAnyPermission, hasFeature, hasPermission, hasPlan, hasRole };
+export { AuthGateClient, type AuthGateConfig, type AuthGateConnection, AuthGateError, type AuthGateProjectConfig, type AuthGateUser, type BackupCodesResponse, type BillingEntitlement, type BillingEntitlementV2, type BillingPlan, type BillingPrice, type BillingSubscription, type BillingSubscriptionItem, type BooleanEntitlementDetail, ConfigurationError, type CookieOptions, DEFAULT_COOKIE_NAME, type EntitlementDetail, InvalidStateError, type MeteredEntitlementDetail, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, type OrgInvitation, type OrgMember, type OrgMembership, type OrgRole, type OrgWithMembership, type Organization, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, type UsageEvent, type UserRoleAssignment, checkFeature, createAuthGateClient, defineConfig, hasAllPermissions, hasAnyPermission, hasFeature, hasMergedPermission, hasPermission, hasPlan, hasRole, mergePermissions };

package/dist/index.d.ts

@@ -989,5 +989,22 @@ declare function hasAnyPermission(membership: OrgMembership | null | undefined,
  * @returns `true` if every permission is granted.
  */
 declare function hasAllPermissions(membership: OrgMembership | null | undefined, permissions: string[]): boolean;
+/** A user's project-level role assignment (no org required). */
+interface UserRoleAssignment {
+    roleKey: string;
+    roleName: string;
+    permissions: string[];
+    assignedAt: string;
+}
+/**
+ * Merge permissions from a project-level role and an org-level role (union).
+ * Either may be null/undefined.
+ */
+declare function mergePermissions(projectRole: UserRoleAssignment | null | undefined, orgMembership: OrgMembership | null | undefined): string[];
+/**
+ * Check a permission against a merged permission set (project + org).
+ * Supports wildcard matching.
+ */
+declare function hasMergedPermission(projectRole: UserRoleAssignment | null | undefined, orgMembership: OrgMembership | null | undefined, permission: string): boolean;
 
-export { AuthGateClient, type AuthGateConfig, type AuthGateConnection, AuthGateError, type AuthGateProjectConfig, type AuthGateUser, type BackupCodesResponse, type BillingEntitlement, type BillingEntitlementV2, type BillingPlan, type BillingPrice, type BillingSubscription, type BillingSubscriptionItem, type BooleanEntitlementDetail, ConfigurationError, type CookieOptions, DEFAULT_COOKIE_NAME, type EntitlementDetail, InvalidStateError, type MeteredEntitlementDetail, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, type OrgInvitation, type OrgMember, type OrgMembership, type OrgRole, type OrgWithMembership, type Organization, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, type UsageEvent, checkFeature, createAuthGateClient, defineConfig, hasAllPermissions, hasAnyPermission, hasFeature, hasPermission, hasPlan, hasRole };
+export { AuthGateClient, type AuthGateConfig, type AuthGateConnection, AuthGateError, type AuthGateProjectConfig, type AuthGateUser, type BackupCodesResponse, type BillingEntitlement, type BillingEntitlementV2, type BillingPlan, type BillingPrice, type BillingSubscription, type BillingSubscriptionItem, type BooleanEntitlementDetail, ConfigurationError, type CookieOptions, DEFAULT_COOKIE_NAME, type EntitlementDetail, InvalidStateError, type MeteredEntitlementDetail, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, type OrgInvitation, type OrgMember, type OrgMembership, type OrgRole, type OrgWithMembership, type Organization, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, type UsageEvent, type UserRoleAssignment, checkFeature, createAuthGateClient, defineConfig, hasAllPermissions, hasAnyPermission, hasFeature, hasMergedPermission, hasPermission, hasPlan, hasRole, mergePermissions };

package/dist/index.mjs

@@ -1280,6 +1280,21 @@ function matchesPermission(granted, required) {
   }
   return false;
 }
+function mergePermissions(projectRole, orgMembership) {
+  var _a;
+  const set = /* @__PURE__ */ new Set();
+  if (projectRole == null ? void 0 : projectRole.permissions) {
+    for (const p of projectRole.permissions) set.add(p);
+  }
+  if ((_a = orgMembership == null ? void 0 : orgMembership.role) == null ? void 0 : _a.permissions) {
+    for (const p of orgMembership.role.permissions) set.add(p);
+  }
+  return [...set];
+}
+function hasMergedPermission(projectRole, orgMembership, permission) {
+  const merged = mergePermissions(projectRole, orgMembership);
+  return matchesPermission(merged, permission);
+}
 export {
   AuthGateClient,
   AuthGateError,
@@ -1299,7 +1314,9 @@ export {
   hasAllPermissions,
   hasAnyPermission,
   hasFeature,
+  hasMergedPermission,
   hasPermission,
   hasPlan,
-  hasRole
+  hasRole,
+  mergePermissions
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-gate/core",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "description": "Core client library for AuthGate — the OAuth proxy that handles provider configuration, token exchange, and user normalization so you don't have to.",
   "type": "module",
   "exports": {