@authhero/multi-tenancy 13.11.0 → 13.12.0

package/dist/multi-tenancy.cjs

@@ -1 +1 @@
-"use strict";var Z=Object.defineProperty;var H=(e,t,s)=>t in e?Z(e,t,{enumerable:!0,configurable:!0,writable:!0,value:s}):e[t]=s;var j=(e,t,s)=>H(e,typeof t!="symbol"?t+"":t,s);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const N=require("hono"),b=require("authhero"),C=require("@hono/zod-openapi"),I=require("@authhero/adapter-interfaces");var v=class extends Error{constructor(t=500,s){super(s==null?void 0:s.message,{cause:s==null?void 0:s.cause});j(this,"res");j(this,"status");this.res=s==null?void 0:s.res,this.status=t}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function U(e){const{controlPlaneTenantId:t,requireOrganizationMatch:s=!0}=e;return{async onTenantAccessValidation(a,i){if(i===t)return!0;if(s){const n=a.var.org_name,u=a.var.organization_id,l=n||u;return l?l===i:!1}return!0}}}function E(e,t,s,a){if(t===s)return!0;const i=a||e;return i?i===t:!1}function K(e){return{async resolveDataAdapters(t){try{return await e.getAdapters(t)}catch(s){console.error(`Failed to resolve data adapters for tenant ${t}:`,s);return}}}}function B(e){return{async beforeCreate(t,s){return!s.audience&&s.id?{...s,audience:b.getTenantAudience(s.id)}:s},async afterCreate(t,s){const{accessControl:a,databaseIsolation:i,settingsInheritance:n}=e;a&&t.ctx&&await x(t,s,a),i!=null&&i.onProvision&&await i.onProvision(s.id),(n==null?void 0:n.inheritFromControlPlane)!==!1&&t.ctx&&await te(t,s,e)},async beforeDelete(t,s){const{accessControl:a,databaseIsolation:i}=e;if(a)try{const u=(await t.adapters.organizations.list(a.controlPlaneTenantId)).organizations.find(l=>l.name===s);u&&await t.adapters.organizations.remove(a.controlPlaneTenantId,u.id)}catch(n){console.warn(`Failed to remove organization for tenant ${s}:`,n)}if(i!=null&&i.onDeprovision)try{await i.onDeprovision(s)}catch(n){console.warn(`Failed to deprovision database for tenant ${s}:`,n)}}}}async function x(e,t,s){const{controlPlaneTenantId:a,defaultPermissions:i,defaultRoles:n,issuer:u,adminRoleName:l="Tenant Admin",adminRoleDescription:c="Full access to all tenant management operations",addCreatorToOrganization:r=!0}=s,f=await e.adapters.organizations.create(a,{name:t.id,display_name:t.friendly_name||t.id});let d;if(u&&(d=await ee(e,a,l,c)),r&&e.ctx){const o=e.ctx.var.user;if(o!=null&&o.sub)try{await e.adapters.userOrganizations.create(a,{user_id:o.sub,organization_id:f.id}),d&&await e.adapters.userRoles.create(a,o.sub,d,f.id)}catch(p){console.warn(`Failed to add creator ${o.sub} to organization ${f.id}:`,p)}}n&&n.length>0&&console.log(`Would assign roles ${n.join(", ")} to organization ${f.id}`),i&&i.length>0&&console.log(`Would grant permissions ${i.join(", ")} to organization ${f.id}`)}async function ee(e,t,s,a){const n=(await e.adapters.roles.list(t,{})).roles.find(r=>r.name===s);if(n)return n.id;const u=await e.adapters.roles.create(t,{name:s,description:a}),l=b.MANAGEMENT_API_AUDIENCE,c=b.MANAGEMENT_API_SCOPES.map(r=>({role_id:u.id,resource_server_identifier:l,permission_name:r.value}));return await e.adapters.rolePermissions.assign(t,u.id,c),u.id}async function te(e,t,s){const{accessControl:a,settingsInheritance:i}=s;if(!a)return;const n=await e.adapters.tenants.get(a.controlPlaneTenantId);if(!n)return;let u={...n};const l=["id","created_at","updated_at","friendly_name","audience","sender_email","sender_name"];for(const c of l)delete u[c];if(i!=null&&i.inheritedKeys){const c={};for(const r of i.inheritedKeys)r in n&&!l.includes(r)&&(c[r]=n[r]);u=c}if(i!=null&&i.excludedKeys)for(const c of i.excludedKeys)delete u[c];i!=null&&i.transformSettings&&(u=i.transformSettings(u,t.id)),Object.keys(u).length>0&&await e.adapters.tenants.update(t.id,u)}function W(e){const{controlPlaneTenantId:t,getChildTenantIds:s,getAdapters:a,shouldSync:i=()=>!0,transformForSync:n}=e;async function u(r,f,d){return(await r.resourceServers.list(f,{q:`identifier:${d}`,per_page:1})).resource_servers[0]??null}async function l(r,f){const d=await s();await Promise.all(d.map(async o=>{try{const p=await a(o),h={...n?n(r,o):{name:r.name,identifier:r.identifier,scopes:r.scopes,signing_alg:r.signing_alg,signing_secret:r.signing_secret,token_lifetime:r.token_lifetime,token_lifetime_for_web:r.token_lifetime_for_web,skip_consent_for_verifiable_first_party_clients:r.skip_consent_for_verifiable_first_party_clients,allow_offline_access:r.allow_offline_access,verificationKey:r.verificationKey,options:r.options},is_system:!0};if(f==="create"){const A=await u(p,o,r.identifier);A&&A.id?await p.resourceServers.update(o,A.id,h):await p.resourceServers.create(o,h)}else{const A=await u(p,o,r.identifier);A&&A.id?await p.resourceServers.update(o,A.id,h):await p.resourceServers.create(o,h)}}catch(p){console.error(`Failed to sync resource server "${r.identifier}" to tenant "${o}":`,p)}}))}async function c(r){const f=await s();await Promise.all(f.map(async d=>{try{const o=await a(d),p=await u(o,d,r);p&&p.id&&await o.resourceServers.remove(d,p.id)}catch(o){console.error(`Failed to delete resource server "${r}" from tenant "${d}":`,o)}}))}return{afterCreate:async(r,f)=>{r.tenantId===t&&i(f)&&await l(f,"create")},afterUpdate:async(r,f,d)=>{r.tenantId===t&&i(d)&&await l(d,"update")},afterDelete:async(r,f)=>{r.tenantId===t&&await c(f)}}}function G(e){const{controlPlaneTenantId:t,getControlPlaneAdapters:s,getAdapters:a,shouldSync:i=()=>!0,transformForSync:n}=e;return{async afterCreate(u,l){if(l.id!==t)try{const c=await s(),r=await a(l.id),f=await b.fetchAll(d=>c.resourceServers.list(t,d),"resource_servers",{cursorField:"id",pageSize:100});await Promise.all(f.filter(d=>i(d)).map(async d=>{const o=d;try{const p=n?n(o,l.id):{name:o.name,identifier:o.identifier,scopes:o.scopes,signing_alg:o.signing_alg,signing_secret:o.signing_secret,token_lifetime:o.token_lifetime,token_lifetime_for_web:o.token_lifetime_for_web,skip_consent_for_verifiable_first_party_clients:o.skip_consent_for_verifiable_first_party_clients,allow_offline_access:o.allow_offline_access,verificationKey:o.verificationKey,options:o.options};await r.resourceServers.create(l.id,{...p,is_system:!0})}catch(p){console.error(`Failed to sync resource server "${o.identifier}" to new tenant "${l.id}":`,p)}}))}catch(c){console.error(`Failed to sync resource servers to new tenant "${l.id}":`,c)}}}}function L(e){const{controlPlaneTenantId:t,getChildTenantIds:s,getAdapters:a,shouldSync:i=()=>!0,transformForSync:n}=e;async function u(c,r,f){return(await c.roles.list(r,{q:`name:${f}`,per_page:1})).roles[0]??null}async function l(c,r){const f=await s();await Promise.all(f.map(async d=>{try{const o=await a(d),g={...n?n(c,d):{name:c.name,description:c.description},is_system:!0};if(r==="create"){const h=await u(o,d,c.name);h&&h.id?await o.roles.update(d,h.id,g):await o.roles.create(d,g)}else{const h=await u(o,d,c.name);h&&h.id?await o.roles.update(d,h.id,g):await o.roles.create(d,g)}}catch(o){console.error(`Failed to sync role "${c.name}" to tenant "${d}":`,o)}}))}return{afterCreate:async(c,r)=>{c.tenantId===t&&i(r)&&await l(r,"create")},afterUpdate:async(c,r,f)=>{c.tenantId===t&&i(f)&&await l(f,"update")},afterDelete:async(c,r)=>{c.tenantId===t&&console.warn(`Role ${r} was deleted from control plane. Child tenant roles with matching names should be deleted manually or implement role name tracking.`)}}}function Q(e){const{controlPlaneTenantId:t,getControlPlaneAdapters:s,getAdapters:a,shouldSync:i=()=>!0,transformForSync:n,syncPermissions:u=!0}=e;return{async afterCreate(l,c){if(c.id!==t)try{const r=await s(),f=await a(c.id),d=await b.fetchAll(p=>r.roles.list(t,p),"roles",{cursorField:"id",pageSize:100}),o=new Map;if(await Promise.all(d.filter(p=>i(p)).map(async p=>{const g=p;try{const h=n?n(g,c.id):{name:g.name,description:g.description},A=await f.roles.create(c.id,{...h,is_system:!0});o.set(g.id,A.id)}catch(h){console.error(`Failed to sync role "${g.name}" to new tenant "${c.id}":`,h)}})),u)for(const[p,g]of o)try{const h=await r.rolePermissions.list(t,p,{});h.length>0&&await f.rolePermissions.assign(c.id,g,h.map(A=>({role_id:g,resource_server_identifier:A.resource_server_identifier,permission_name:A.permission_name})))}catch(h){console.error(`Failed to sync permissions for role to new tenant "${c.id}":`,h)}}catch(r){console.error(`Failed to sync roles to new tenant "${c.id}":`,r)}}}}function D(e,t){const s=new C.OpenAPIHono;return s.openapi(C.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:I.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:C.z.object({tenants:C.z.array(I.tenantSchema),start:C.z.number().optional(),limit:C.z.number().optional(),length:C.z.number().optional()})}},description:"List of tenants"}}}),async a=>{var p,g,h,A;const i=a.req.valid("query"),{page:n,per_page:u,include_totals:l,q:c}=i,r=a.var.user,f=((r==null?void 0:r.scope)||"").split(" "),d=f.includes("auth:read");if(console.log("User scopes:",f,"hasAuthRead:",d),d){const S=await a.env.data.tenants.list({page:n,per_page:u,include_totals:l,q:c});return l?a.json({tenants:S.tenants,start:((p=S.totals)==null?void 0:p.start)??0,limit:((g=S.totals)==null?void 0:g.limit)??u,length:S.tenants.length}):a.json({tenants:S.tenants})}if(e.accessControl&&(r!=null&&r.sub)){const S=e.accessControl.controlPlaneTenantId,M=(await b.fetchAll(R=>a.env.data.userOrganizations.listUserOrganizations(S,r.sub,R),"organizations")).map(R=>R.name);if(M.length===0)return l?a.json({tenants:[],start:0,limit:u??50,length:0}):a.json({tenants:[]});const $=M.length,F=n??0,P=u??50,w=F*P,m=M.slice(w,w+P);if(m.length===0)return l?a.json({tenants:[],start:w,limit:P,length:$}):a.json({tenants:[]});const y=m.map(R=>`id:${R}`).join(" OR "),_=c?`(${y}) AND (${c})`:y,T=await a.env.data.tenants.list({q:_,per_page:P,include_totals:!1});return l?a.json({tenants:T.tenants,start:w,limit:P,length:$}):a.json({tenants:T.tenants})}const o=await a.env.data.tenants.list({page:n,per_page:u,include_totals:l,q:c});return l?a.json({tenants:o.tenants,start:((h=o.totals)==null?void 0:h.start)??0,limit:((A=o.totals)==null?void 0:A.limit)??u,length:o.tenants.length}):a.json({tenants:o.tenants})}),s.openapi(C.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:I.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:I.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async a=>{var c,r;const i=a.var.user;if(!(i!=null&&i.sub))throw new v(401,{message:"Authentication required to create tenants"});let n=a.req.valid("json");const u={adapters:a.env.data,ctx:a};(c=t.tenants)!=null&&c.beforeCreate&&(n=await t.tenants.beforeCreate(u,n));const l=await a.env.data.tenants.create(n);return(r=t.tenants)!=null&&r.afterCreate&&await t.tenants.afterCreate(u,l),a.json(l,201)}),s.openapi(C.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:C.z.object({id:C.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async a=>{var l,c;const{id:i}=a.req.valid("param");if(e.accessControl){const r=a.var.user,f=e.accessControl.controlPlaneTenantId;if(!(r!=null&&r.sub))throw new v(401,{message:"Authentication required"});if(i===f)throw new v(403,{message:"Cannot delete the control plane"});if(!(await b.fetchAll(p=>a.env.data.userOrganizations.listUserOrganizations(f,r.sub,p),"organizations")).some(p=>p.name===i))throw new v(403,{message:"Access denied to this tenant"})}if(!await a.env.data.tenants.get(i))throw new v(404,{message:"Tenant not found"});const u={adapters:a.env.data,ctx:a};return(l=t.tenants)!=null&&l.beforeDelete&&await t.tenants.beforeDelete(u,i),await a.env.data.tenants.remove(i),(c=t.tenants)!=null&&c.afterDelete&&await t.tenants.afterDelete(u,i),a.body(null,204)}),s}function ae(e){const t=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:s,type:a}of t){const i=e.match(s);if(i&&i[1])return{type:a,id:i[1]}}return null}async function ne(e,t,s){try{switch(s.type){case"resource_server":{const a=await e.resourceServers.get(t,s.id);return(a==null?void 0:a.is_system)===!0}case"role":{const a=await e.roles.get(t,s.id);return(a==null?void 0:a.is_system)===!0}case"connection":{const a=await e.connections.get(t,s.id);return(a==null?void 0:a.is_system)===!0}default:return!1}}catch{return!1}}function re(e){return{resource_server:"resource server",role:"role",connection:"connection"}[e]}function V(){return async(e,t)=>{if(!["PATCH","PUT","DELETE"].includes(e.req.method))return t();const s=ae(e.req.path);if(!s)return t();const a=e.var.tenant_id||e.req.header("x-tenant-id")||e.req.header("tenant-id");if(!a)return t();if(await ne(e.env.data,a,s))throw new v(403,{message:`This ${re(s.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return t()}}function k(e){return async(t,s)=>{if(!e.accessControl)return s();const a=t.var.tenant_id,i=t.var.organization_id;if(!a)throw new v(400,{message:"Tenant ID not found in request"});if(!E(i,a,e.accessControl.controlPlaneTenantId))throw new v(403,{message:`Access denied to tenant ${a}`});return s()}}function J(e){return async(t,s)=>{if(!e.subdomainRouting)return s();const{baseDomain:a,reservedSubdomains:i=[],resolveSubdomain:n}=e.subdomainRouting,u=t.req.header("host")||"";let l=null;if(u.endsWith(a)){const r=u.slice(0,-(a.length+1));r&&!r.includes(".")&&(l=r)}if(l&&i.includes(l)&&(l=null),!l)return e.accessControl&&t.set("tenant_id",e.accessControl.controlPlaneTenantId),s();let c=null;if(n)c=await n(l);else if(e.subdomainRouting.useOrganizations!==!1&&e.accessControl)try{const r=await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId,l);r&&(c=r.id)}catch{}if(!c)throw new v(404,{message:`Tenant not found for subdomain: ${l}`});return t.set("tenant_id",c),s()}}function X(e){return async(t,s)=>{if(!e.databaseIsolation)return s();const a=t.var.tenant_id;if(!a)throw new v(400,{message:"Tenant ID not found in request"});try{const i=await e.databaseIsolation.getAdapters(a);t.env.data=i}catch(i){throw console.error(`Failed to resolve database for tenant ${a}:`,i),new v(500,{message:"Failed to resolve tenant database"})}return s()}}function q(e){const t=J(e),s=k(e),a=X(e);return async(i,n)=>(await t(i,async()=>{}),await s(i,async()=>{}),await a(i,async()=>{}),n())}function se(e){const t=z(e);return{name:"multi-tenancy",middleware:q(e),hooks:t,routes:[{path:"/management",handler:D(e,t)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),e.accessControl&&console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`),e.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`),e.databaseIsolation&&console.log("  - Database isolation enabled")}}}function z(e){const t=e.accessControl?U(e.accessControl):{},s=e.databaseIsolation?K(e.databaseIsolation):{},a=B(e);return{...t,...s,tenants:a}}function Y(e){const t=new N.Hono,s=z(e);return t.route("/tenants",D(e,s)),t}function ie(e){return{hooks:z(e),middleware:q(e),app:Y(e),config:e}}function oe(e){const{controlPlaneTenantId:t="control_plane",syncResourceServers:s=!0,syncRoles:a=!0,multiTenancy:i,entityHooks:n,...u}=e,l={...i,accessControl:{controlPlaneTenantId:t,requireOrganizationMatch:!1,defaultPermissions:["tenant:admin"],...i==null?void 0:i.accessControl}},c=z(l);let r,f;s&&(r=W({controlPlaneTenantId:t,getChildTenantIds:async()=>(await b.fetchAll(m=>e.dataAdapter.tenants.list(m),"tenants",{cursorField:"id",pageSize:100})).filter(m=>m.id!==t).map(m=>m.id),getAdapters:async w=>e.dataAdapter}),f=G({controlPlaneTenantId:t,getControlPlaneAdapters:async()=>e.dataAdapter,getAdapters:async w=>e.dataAdapter}));let d,o;a&&(d=L({controlPlaneTenantId:t,getChildTenantIds:async()=>(await b.fetchAll(m=>e.dataAdapter.tenants.list(m),"tenants",{cursorField:"id",pageSize:100})).filter(m=>m.id!==t).map(m=>m.id),getAdapters:async w=>e.dataAdapter}),o=Q({controlPlaneTenantId:t,getControlPlaneAdapters:async()=>e.dataAdapter,getAdapters:async w=>e.dataAdapter,syncPermissions:!0}));const p=async(w,m,...y)=>{const _=[];if(w)try{await w(...y)}catch(T){_.push(T instanceof Error?T:new Error(String(T)))}if(m)try{await m(...y)}catch(T){_.push(T instanceof Error?T:new Error(String(T)))}if(_.length===1)throw _[0];if(_.length>1)throw new AggregateError(_,`Multiple hook errors: ${_.map(T=>T.message).join("; ")}`)},g=async(w,...m)=>{const y=[];for(const _ of w)if(_)try{await _(...m)}catch(T){y.push(T instanceof Error?T:new Error(String(T)))}if(y.length===1)throw y[0];if(y.length>1)throw new AggregateError(y,`Multiple hook errors: ${y.map(_=>_.message).join("; ")}`)},h={...n,resourceServers:r?{...n==null?void 0:n.resourceServers,afterCreate:async(w,m)=>{var y;await p((y=n==null?void 0:n.resourceServers)==null?void 0:y.afterCreate,r==null?void 0:r.afterCreate,w,m)},afterUpdate:async(w,m,y)=>{var _;await p((_=n==null?void 0:n.resourceServers)==null?void 0:_.afterUpdate,r==null?void 0:r.afterUpdate,w,m,y)},afterDelete:async(w,m)=>{var y;await p((y=n==null?void 0:n.resourceServers)==null?void 0:y.afterDelete,r==null?void 0:r.afterDelete,w,m)}}:n==null?void 0:n.resourceServers,roles:d?{...n==null?void 0:n.roles,afterCreate:async(w,m)=>{var y;await p((y=n==null?void 0:n.roles)==null?void 0:y.afterCreate,d==null?void 0:d.afterCreate,w,m)},afterUpdate:async(w,m,y)=>{var _;await p((_=n==null?void 0:n.roles)==null?void 0:_.afterUpdate,d==null?void 0:d.afterUpdate,w,m,y)},afterDelete:async(w,m)=>{var y;await p((y=n==null?void 0:n.roles)==null?void 0:y.afterDelete,d==null?void 0:d.afterDelete,w,m)}}:n==null?void 0:n.roles,tenants:f||o?{...n==null?void 0:n.tenants,afterCreate:async(w,m)=>{var y;await g([(y=n==null?void 0:n.tenants)==null?void 0:y.afterCreate,f==null?void 0:f.afterCreate,o==null?void 0:o.afterCreate],w,m)}}:n==null?void 0:n.tenants},A={...c,tenants:f||o?{...c.tenants,afterCreate:async(w,m)=>{var y;(y=c.tenants)!=null&&y.afterCreate&&await c.tenants.afterCreate(w,m),await g([f==null?void 0:f.afterCreate,o==null?void 0:o.afterCreate],w,m)}}:c.tenants},S=D(l,A),O=b.init({...u,entityHooks:h,managementApiExtensions:[...u.managementApiExtensions||[],{path:"/tenants",router:S}]}),{app:M,managementApp:$,...F}=O,P=new N.Hono;return P.onError((w,m)=>w instanceof v?w.getResponse():(console.error(w),m.json({message:"Internal Server Error"},500))),P.use("/api/v2/*",V()),P.route("/",M),{app:P,managementApp:$,...F,multiTenancyConfig:l,multiTenancyHooks:c}}Object.defineProperty(exports,"MANAGEMENT_API_SCOPES",{enumerable:!0,get:()=>b.MANAGEMENT_API_SCOPES});Object.defineProperty(exports,"fetchAll",{enumerable:!0,get:()=>b.fetchAll});Object.defineProperty(exports,"seed",{enumerable:!0,get:()=>b.seed});exports.createAccessControlHooks=U;exports.createAccessControlMiddleware=k;exports.createDatabaseHooks=K;exports.createDatabaseMiddleware=X;exports.createMultiTenancy=Y;exports.createMultiTenancyHooks=z;exports.createMultiTenancyMiddleware=q;exports.createMultiTenancyPlugin=se;exports.createProtectSyncedMiddleware=V;exports.createProvisioningHooks=B;exports.createResourceServerSyncHooks=W;exports.createRoleSyncHooks=L;exports.createSubdomainMiddleware=J;exports.createTenantResourceServerSyncHooks=G;exports.createTenantRoleSyncHooks=Q;exports.createTenantsOpenAPIRouter=D;exports.init=oe;exports.setupMultiTenancy=ie;exports.validateTenantAccess=E;
+"use strict";var Z=Object.defineProperty;var H=(e,t,s)=>t in e?Z(e,t,{enumerable:!0,configurable:!0,writable:!0,value:s}):e[t]=s;var F=(e,t,s)=>H(e,typeof t!="symbol"?t+"":t,s);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const N=require("hono"),T=require("authhero"),C=require("@hono/zod-openapi"),I=require("@authhero/adapter-interfaces");var v=class extends Error{constructor(t=500,s){super(s==null?void 0:s.message,{cause:s==null?void 0:s.cause});F(this,"res");F(this,"status");this.res=s==null?void 0:s.res,this.status=t}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function U(e){const{controlPlaneTenantId:t,requireOrganizationMatch:s=!0}=e;return{async onTenantAccessValidation(a,i){if(i===t)return!0;if(s){const n=a.var.org_name,u=a.var.organization_id,l=n||u;return l?l===i:!1}return!0}}}function E(e,t,s,a){if(t===s)return!0;const i=a||e;return i?i===t:!1}function K(e){return{async resolveDataAdapters(t){try{return await e.getAdapters(t)}catch(s){console.error(`Failed to resolve data adapters for tenant ${t}:`,s);return}}}}function G(e){return{async beforeCreate(t,s){return!s.audience&&s.id?{...s,audience:T.getTenantAudience(s.id)}:s},async afterCreate(t,s){const{accessControl:a,databaseIsolation:i,settingsInheritance:n}=e;a&&t.ctx&&await x(t,s,a),i!=null&&i.onProvision&&await i.onProvision(s.id),(n==null?void 0:n.inheritFromControlPlane)!==!1&&t.ctx&&await ae(t,s,e)},async beforeDelete(t,s){const{accessControl:a,databaseIsolation:i}=e;if(a)try{const u=(await t.adapters.organizations.list(a.controlPlaneTenantId)).organizations.find(l=>l.name===s);u&&await t.adapters.organizations.remove(a.controlPlaneTenantId,u.id)}catch(n){console.warn(`Failed to remove organization for tenant ${s}:`,n)}if(i!=null&&i.onDeprovision)try{await i.onDeprovision(s)}catch(n){console.warn(`Failed to deprovision database for tenant ${s}:`,n)}}}}async function x(e,t,s){const{controlPlaneTenantId:a,defaultPermissions:i,defaultRoles:n,issuer:u,adminRoleName:l="Tenant Admin",adminRoleDescription:c="Full access to all tenant management operations",addCreatorToOrganization:r=!0}=s,f=await e.adapters.organizations.create(a,{name:t.id,display_name:t.friendly_name||t.id});let d;if(u&&(d=await te(e,a,l,c)),r&&e.ctx){const o=e.ctx.var.user;if(o!=null&&o.sub&&!await ee(e,a,o.sub))try{await e.adapters.userOrganizations.create(a,{user_id:o.sub,organization_id:f.id}),d&&await e.adapters.userRoles.create(a,o.sub,d,f.id)}catch(g){console.warn(`Failed to add creator ${o.sub} to organization ${f.id}:`,g)}}n&&n.length>0&&console.log(`Would assign roles ${n.join(", ")} to organization ${f.id}`),i&&i.length>0&&console.log(`Would grant permissions ${i.join(", ")} to organization ${f.id}`)}async function ee(e,t,s){const a=await e.adapters.userRoles.list(t,s,void 0,"");for(const i of a)if((await e.adapters.rolePermissions.list(t,i.id,{per_page:1e3})).some(l=>l.permission_name==="admin:organizations"))return!0;return!1}async function te(e,t,s,a){const n=(await e.adapters.roles.list(t,{})).roles.find(r=>r.name===s);if(n)return n.id;const u=await e.adapters.roles.create(t,{name:s,description:a}),l=T.MANAGEMENT_API_AUDIENCE,c=T.MANAGEMENT_API_SCOPES.map(r=>({role_id:u.id,resource_server_identifier:l,permission_name:r.value}));return await e.adapters.rolePermissions.assign(t,u.id,c),u.id}async function ae(e,t,s){const{accessControl:a,settingsInheritance:i}=s;if(!a)return;const n=await e.adapters.tenants.get(a.controlPlaneTenantId);if(!n)return;let u={...n};const l=["id","created_at","updated_at","friendly_name","audience","sender_email","sender_name"];for(const c of l)delete u[c];if(i!=null&&i.inheritedKeys){const c={};for(const r of i.inheritedKeys)r in n&&!l.includes(r)&&(c[r]=n[r]);u=c}if(i!=null&&i.excludedKeys)for(const c of i.excludedKeys)delete u[c];i!=null&&i.transformSettings&&(u=i.transformSettings(u,t.id)),Object.keys(u).length>0&&await e.adapters.tenants.update(t.id,u)}function B(e){const{controlPlaneTenantId:t,getChildTenantIds:s,getAdapters:a,shouldSync:i=()=>!0,transformForSync:n}=e;async function u(r,f,d){return(await r.resourceServers.list(f,{q:`identifier:${d}`,per_page:1})).resource_servers[0]??null}async function l(r,f){const d=await s();await Promise.all(d.map(async o=>{try{const p=await a(o),h={...n?n(r,o):{name:r.name,identifier:r.identifier,scopes:r.scopes,signing_alg:r.signing_alg,signing_secret:r.signing_secret,token_lifetime:r.token_lifetime,token_lifetime_for_web:r.token_lifetime_for_web,skip_consent_for_verifiable_first_party_clients:r.skip_consent_for_verifiable_first_party_clients,allow_offline_access:r.allow_offline_access,verificationKey:r.verificationKey,options:r.options},is_system:!0};if(f==="create"){const A=await u(p,o,r.identifier);A&&A.id?await p.resourceServers.update(o,A.id,h):await p.resourceServers.create(o,h)}else{const A=await u(p,o,r.identifier);A&&A.id?await p.resourceServers.update(o,A.id,h):await p.resourceServers.create(o,h)}}catch(p){console.error(`Failed to sync resource server "${r.identifier}" to tenant "${o}":`,p)}}))}async function c(r){const f=await s();await Promise.all(f.map(async d=>{try{const o=await a(d),p=await u(o,d,r);p&&p.id&&await o.resourceServers.remove(d,p.id)}catch(o){console.error(`Failed to delete resource server "${r}" from tenant "${d}":`,o)}}))}return{afterCreate:async(r,f)=>{r.tenantId===t&&i(f)&&await l(f,"create")},afterUpdate:async(r,f,d)=>{r.tenantId===t&&i(d)&&await l(d,"update")},afterDelete:async(r,f)=>{r.tenantId===t&&await c(f)}}}function W(e){const{controlPlaneTenantId:t,getControlPlaneAdapters:s,getAdapters:a,shouldSync:i=()=>!0,transformForSync:n}=e;return{async afterCreate(u,l){if(l.id!==t)try{const c=await s(),r=await a(l.id),f=await T.fetchAll(d=>c.resourceServers.list(t,d),"resource_servers",{cursorField:"id",pageSize:100});await Promise.all(f.filter(d=>i(d)).map(async d=>{const o=d;try{const p=n?n(o,l.id):{name:o.name,identifier:o.identifier,scopes:o.scopes,signing_alg:o.signing_alg,signing_secret:o.signing_secret,token_lifetime:o.token_lifetime,token_lifetime_for_web:o.token_lifetime_for_web,skip_consent_for_verifiable_first_party_clients:o.skip_consent_for_verifiable_first_party_clients,allow_offline_access:o.allow_offline_access,verificationKey:o.verificationKey,options:o.options};await r.resourceServers.create(l.id,{...p,is_system:!0})}catch(p){console.error(`Failed to sync resource server "${o.identifier}" to new tenant "${l.id}":`,p)}}))}catch(c){console.error(`Failed to sync resource servers to new tenant "${l.id}":`,c)}}}}function L(e){const{controlPlaneTenantId:t,getChildTenantIds:s,getAdapters:a,shouldSync:i=()=>!0,transformForSync:n}=e;async function u(c,r,f){return(await c.roles.list(r,{q:`name:${f}`,per_page:1})).roles[0]??null}async function l(c,r){const f=await s();await Promise.all(f.map(async d=>{try{const o=await a(d),g={...n?n(c,d):{name:c.name,description:c.description},is_system:!0};if(r==="create"){const h=await u(o,d,c.name);h&&h.id?await o.roles.update(d,h.id,g):await o.roles.create(d,g)}else{const h=await u(o,d,c.name);h&&h.id?await o.roles.update(d,h.id,g):await o.roles.create(d,g)}}catch(o){console.error(`Failed to sync role "${c.name}" to tenant "${d}":`,o)}}))}return{afterCreate:async(c,r)=>{c.tenantId===t&&i(r)&&await l(r,"create")},afterUpdate:async(c,r,f)=>{c.tenantId===t&&i(f)&&await l(f,"update")},afterDelete:async(c,r)=>{c.tenantId===t&&console.warn(`Role ${r} was deleted from control plane. Child tenant roles with matching names should be deleted manually or implement role name tracking.`)}}}function Q(e){const{controlPlaneTenantId:t,getControlPlaneAdapters:s,getAdapters:a,shouldSync:i=()=>!0,transformForSync:n,syncPermissions:u=!0}=e;return{async afterCreate(l,c){if(c.id!==t)try{const r=await s(),f=await a(c.id),d=await T.fetchAll(p=>r.roles.list(t,p),"roles",{cursorField:"id",pageSize:100}),o=new Map;if(await Promise.all(d.filter(p=>i(p)).map(async p=>{const g=p;try{const h=n?n(g,c.id):{name:g.name,description:g.description},A=await f.roles.create(c.id,{...h,is_system:!0});o.set(g.id,A.id)}catch(h){console.error(`Failed to sync role "${g.name}" to new tenant "${c.id}":`,h)}})),u)for(const[p,g]of o)try{const h=await r.rolePermissions.list(t,p,{});h.length>0&&await f.rolePermissions.assign(c.id,g,h.map(A=>({role_id:g,resource_server_identifier:A.resource_server_identifier,permission_name:A.permission_name})))}catch(h){console.error(`Failed to sync permissions for role to new tenant "${c.id}":`,h)}}catch(r){console.error(`Failed to sync roles to new tenant "${c.id}":`,r)}}}}function O(e,t){const s=new C.OpenAPIHono;return s.openapi(C.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:I.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:C.z.object({tenants:C.z.array(I.tenantSchema),start:C.z.number().optional(),limit:C.z.number().optional(),length:C.z.number().optional()})}},description:"List of tenants"}}}),async a=>{var p,g,h,A;const i=a.req.valid("query"),{page:n,per_page:u,include_totals:l,q:c}=i,r=a.var.user,f=((r==null?void 0:r.scope)||"").split(" "),d=f.includes("auth:read");if(console.log("User scopes:",f,"hasAuthRead:",d),d){const S=await a.env.data.tenants.list({page:n,per_page:u,include_totals:l,q:c});return l?a.json({tenants:S.tenants,start:((p=S.totals)==null?void 0:p.start)??0,limit:((g=S.totals)==null?void 0:g.limit)??u,length:S.tenants.length}):a.json({tenants:S.tenants})}if(e.accessControl&&(r!=null&&r.sub)){const S=e.accessControl.controlPlaneTenantId,R=(await T.fetchAll(M=>a.env.data.userOrganizations.listUserOrganizations(S,r.sub,M),"organizations")).map(M=>M.name);if(R.length===0)return l?a.json({tenants:[],start:0,limit:u??50,length:0}):a.json({tenants:[]});const $=R.length,D=n??0,P=u??50,w=D*P,m=R.slice(w,w+P);if(m.length===0)return l?a.json({tenants:[],start:w,limit:P,length:$}):a.json({tenants:[]});const y=m.map(M=>`id:${M}`).join(" OR "),_=c?`(${y}) AND (${c})`:y,b=await a.env.data.tenants.list({q:_,per_page:P,include_totals:!1});return l?a.json({tenants:b.tenants,start:w,limit:P,length:$}):a.json({tenants:b.tenants})}const o=await a.env.data.tenants.list({page:n,per_page:u,include_totals:l,q:c});return l?a.json({tenants:o.tenants,start:((h=o.totals)==null?void 0:h.start)??0,limit:((A=o.totals)==null?void 0:A.limit)??u,length:o.tenants.length}):a.json({tenants:o.tenants})}),s.openapi(C.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:I.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:I.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async a=>{var c,r;const i=a.var.user;if(!(i!=null&&i.sub))throw new v(401,{message:"Authentication required to create tenants"});let n=a.req.valid("json");const u={adapters:a.env.data,ctx:a};(c=t.tenants)!=null&&c.beforeCreate&&(n=await t.tenants.beforeCreate(u,n));const l=await a.env.data.tenants.create(n);return(r=t.tenants)!=null&&r.afterCreate&&await t.tenants.afterCreate(u,l),a.json(l,201)}),s.openapi(C.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:C.z.object({id:C.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async a=>{var l,c;const{id:i}=a.req.valid("param");if(e.accessControl){const r=a.var.user,f=e.accessControl.controlPlaneTenantId;if(!(r!=null&&r.sub))throw new v(401,{message:"Authentication required"});if(i===f)throw new v(403,{message:"Cannot delete the control plane"});if(!(await T.fetchAll(p=>a.env.data.userOrganizations.listUserOrganizations(f,r.sub,p),"organizations")).some(p=>p.name===i))throw new v(403,{message:"Access denied to this tenant"})}if(!await a.env.data.tenants.get(i))throw new v(404,{message:"Tenant not found"});const u={adapters:a.env.data,ctx:a};return(l=t.tenants)!=null&&l.beforeDelete&&await t.tenants.beforeDelete(u,i),await a.env.data.tenants.remove(i),(c=t.tenants)!=null&&c.afterDelete&&await t.tenants.afterDelete(u,i),a.body(null,204)}),s}function ne(e){const t=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:s,type:a}of t){const i=e.match(s);if(i&&i[1])return{type:a,id:i[1]}}return null}async function re(e,t,s){try{switch(s.type){case"resource_server":{const a=await e.resourceServers.get(t,s.id);return(a==null?void 0:a.is_system)===!0}case"role":{const a=await e.roles.get(t,s.id);return(a==null?void 0:a.is_system)===!0}case"connection":{const a=await e.connections.get(t,s.id);return(a==null?void 0:a.is_system)===!0}default:return!1}}catch{return!1}}function se(e){return{resource_server:"resource server",role:"role",connection:"connection"}[e]}function V(){return async(e,t)=>{if(!["PATCH","PUT","DELETE"].includes(e.req.method))return t();const s=ne(e.req.path);if(!s)return t();const a=e.var.tenant_id||e.req.header("x-tenant-id")||e.req.header("tenant-id");if(!a)return t();if(await re(e.env.data,a,s))throw new v(403,{message:`This ${se(s.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return t()}}function k(e){return async(t,s)=>{if(!e.accessControl)return s();const a=t.var.tenant_id,i=t.var.organization_id;if(!a)throw new v(400,{message:"Tenant ID not found in request"});if(!E(i,a,e.accessControl.controlPlaneTenantId))throw new v(403,{message:`Access denied to tenant ${a}`});return s()}}function J(e){return async(t,s)=>{if(!e.subdomainRouting)return s();const{baseDomain:a,reservedSubdomains:i=[],resolveSubdomain:n}=e.subdomainRouting,u=t.req.header("host")||"";let l=null;if(u.endsWith(a)){const r=u.slice(0,-(a.length+1));r&&!r.includes(".")&&(l=r)}if(l&&i.includes(l)&&(l=null),!l)return e.accessControl&&t.set("tenant_id",e.accessControl.controlPlaneTenantId),s();let c=null;if(n)c=await n(l);else if(e.subdomainRouting.useOrganizations!==!1&&e.accessControl)try{const r=await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId,l);r&&(c=r.id)}catch{}if(!c)throw new v(404,{message:`Tenant not found for subdomain: ${l}`});return t.set("tenant_id",c),s()}}function X(e){return async(t,s)=>{if(!e.databaseIsolation)return s();const a=t.var.tenant_id;if(!a)throw new v(400,{message:"Tenant ID not found in request"});try{const i=await e.databaseIsolation.getAdapters(a);t.env.data=i}catch(i){throw console.error(`Failed to resolve database for tenant ${a}:`,i),new v(500,{message:"Failed to resolve tenant database"})}return s()}}function j(e){const t=J(e),s=k(e),a=X(e);return async(i,n)=>(await t(i,async()=>{}),await s(i,async()=>{}),await a(i,async()=>{}),n())}function ie(e){const t=z(e);return{name:"multi-tenancy",middleware:j(e),hooks:t,routes:[{path:"/management",handler:O(e,t)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),e.accessControl&&console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`),e.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`),e.databaseIsolation&&console.log("  - Database isolation enabled")}}}function z(e){const t=e.accessControl?U(e.accessControl):{},s=e.databaseIsolation?K(e.databaseIsolation):{},a=G(e);return{...t,...s,tenants:a}}function Y(e){const t=new N.Hono,s=z(e);return t.route("/tenants",O(e,s)),t}function oe(e){return{hooks:z(e),middleware:j(e),app:Y(e),config:e}}function ce(e){const{controlPlaneTenantId:t="control_plane",syncResourceServers:s=!0,syncRoles:a=!0,multiTenancy:i,entityHooks:n,...u}=e,l={...i,accessControl:{controlPlaneTenantId:t,requireOrganizationMatch:!1,defaultPermissions:["tenant:admin"],...i==null?void 0:i.accessControl}},c=z(l);let r,f;s&&(r=B({controlPlaneTenantId:t,getChildTenantIds:async()=>(await T.fetchAll(m=>e.dataAdapter.tenants.list(m),"tenants",{cursorField:"id",pageSize:100})).filter(m=>m.id!==t).map(m=>m.id),getAdapters:async w=>e.dataAdapter}),f=W({controlPlaneTenantId:t,getControlPlaneAdapters:async()=>e.dataAdapter,getAdapters:async w=>e.dataAdapter}));let d,o;a&&(d=L({controlPlaneTenantId:t,getChildTenantIds:async()=>(await T.fetchAll(m=>e.dataAdapter.tenants.list(m),"tenants",{cursorField:"id",pageSize:100})).filter(m=>m.id!==t).map(m=>m.id),getAdapters:async w=>e.dataAdapter}),o=Q({controlPlaneTenantId:t,getControlPlaneAdapters:async()=>e.dataAdapter,getAdapters:async w=>e.dataAdapter,syncPermissions:!0}));const p=async(w,m,...y)=>{const _=[];if(w)try{await w(...y)}catch(b){_.push(b instanceof Error?b:new Error(String(b)))}if(m)try{await m(...y)}catch(b){_.push(b instanceof Error?b:new Error(String(b)))}if(_.length===1)throw _[0];if(_.length>1)throw new AggregateError(_,`Multiple hook errors: ${_.map(b=>b.message).join("; ")}`)},g=async(w,...m)=>{const y=[];for(const _ of w)if(_)try{await _(...m)}catch(b){y.push(b instanceof Error?b:new Error(String(b)))}if(y.length===1)throw y[0];if(y.length>1)throw new AggregateError(y,`Multiple hook errors: ${y.map(_=>_.message).join("; ")}`)},h={...n,resourceServers:r?{...n==null?void 0:n.resourceServers,afterCreate:async(w,m)=>{var y;await p((y=n==null?void 0:n.resourceServers)==null?void 0:y.afterCreate,r==null?void 0:r.afterCreate,w,m)},afterUpdate:async(w,m,y)=>{var _;await p((_=n==null?void 0:n.resourceServers)==null?void 0:_.afterUpdate,r==null?void 0:r.afterUpdate,w,m,y)},afterDelete:async(w,m)=>{var y;await p((y=n==null?void 0:n.resourceServers)==null?void 0:y.afterDelete,r==null?void 0:r.afterDelete,w,m)}}:n==null?void 0:n.resourceServers,roles:d?{...n==null?void 0:n.roles,afterCreate:async(w,m)=>{var y;await p((y=n==null?void 0:n.roles)==null?void 0:y.afterCreate,d==null?void 0:d.afterCreate,w,m)},afterUpdate:async(w,m,y)=>{var _;await p((_=n==null?void 0:n.roles)==null?void 0:_.afterUpdate,d==null?void 0:d.afterUpdate,w,m,y)},afterDelete:async(w,m)=>{var y;await p((y=n==null?void 0:n.roles)==null?void 0:y.afterDelete,d==null?void 0:d.afterDelete,w,m)}}:n==null?void 0:n.roles,tenants:f||o?{...n==null?void 0:n.tenants,afterCreate:async(w,m)=>{var y;await g([(y=n==null?void 0:n.tenants)==null?void 0:y.afterCreate,f==null?void 0:f.afterCreate,o==null?void 0:o.afterCreate],w,m)}}:n==null?void 0:n.tenants},A={...c,tenants:f||o?{...c.tenants,afterCreate:async(w,m)=>{var y;(y=c.tenants)!=null&&y.afterCreate&&await c.tenants.afterCreate(w,m),await g([f==null?void 0:f.afterCreate,o==null?void 0:o.afterCreate],w,m)}}:c.tenants},S=O(l,A),q=T.init({...u,entityHooks:h,managementApiExtensions:[...u.managementApiExtensions||[],{path:"/tenants",router:S}]}),{app:R,managementApp:$,...D}=q,P=new N.Hono;return P.onError((w,m)=>w instanceof v?w.getResponse():(console.error(w),m.json({message:"Internal Server Error"},500))),P.use("/api/v2/*",V()),P.route("/",R),{app:P,managementApp:$,...D,multiTenancyConfig:l,multiTenancyHooks:c}}Object.defineProperty(exports,"MANAGEMENT_API_SCOPES",{enumerable:!0,get:()=>T.MANAGEMENT_API_SCOPES});Object.defineProperty(exports,"fetchAll",{enumerable:!0,get:()=>T.fetchAll});Object.defineProperty(exports,"seed",{enumerable:!0,get:()=>T.seed});exports.createAccessControlHooks=U;exports.createAccessControlMiddleware=k;exports.createDatabaseHooks=K;exports.createDatabaseMiddleware=X;exports.createMultiTenancy=Y;exports.createMultiTenancyHooks=z;exports.createMultiTenancyMiddleware=j;exports.createMultiTenancyPlugin=ie;exports.createProtectSyncedMiddleware=V;exports.createProvisioningHooks=G;exports.createResourceServerSyncHooks=B;exports.createRoleSyncHooks=L;exports.createSubdomainMiddleware=J;exports.createTenantResourceServerSyncHooks=W;exports.createTenantRoleSyncHooks=Q;exports.createTenantsOpenAPIRouter=O;exports.init=ce;exports.setupMultiTenancy=oe;exports.validateTenantAccess=E;

package/dist/multi-tenancy.mjs

@@ -2,11 +2,11 @@ var K = Object.defineProperty;
 var E = (e, t, s) => t in e ? K(e, t, { enumerable: !0, configurable: !0, writable: !0, value: s }) : e[t] = s;
 var D = (e, t, s) => E(e, typeof t != "symbol" ? t + "" : t, s);
 import { Hono as U } from "hono";
-import { getTenantAudience as B, MANAGEMENT_API_SCOPES as W, MANAGEMENT_API_AUDIENCE as G, fetchAll as S, init as L } from "authhero";
-import { MANAGEMENT_API_SCOPES as ve, fetchAll as be, seed as Pe } from "authhero";
+import { getTenantAudience as G, MANAGEMENT_API_SCOPES as B, MANAGEMENT_API_AUDIENCE as W, fetchAll as S, init as L } from "authhero";
+import { MANAGEMENT_API_SCOPES as Ce, fetchAll as Pe, seed as Se } from "authhero";
 import { OpenAPIHono as Q, createRoute as M, z as P } from "@hono/zod-openapi";
-import { auth0QuerySchema as V, tenantSchema as O, tenantInsertSchema as J } from "@authhero/adapter-interfaces";
-var C = class extends Error {
+import { auth0QuerySchema as V, tenantSchema as q, tenantInsertSchema as J } from "@authhero/adapter-interfaces";
+var T = class extends Error {
   /**
    * Creates an instance of `HTTPException`.
    * @param status - HTTP status code for the exception. Defaults to 500.
@@ -72,12 +72,12 @@ function k(e) {
     async beforeCreate(t, s) {
       return !s.audience && s.id ? {
         ...s,
-        audience: B(s.id)
+        audience: G(s.id)
       } : s;
     },
     async afterCreate(t, s) {
       const { accessControl: a, databaseIsolation: i, settingsInheritance: n } = e;
-      a && t.ctx && await H(t, s, a), i != null && i.onProvision && await i.onProvision(s.id), (n == null ? void 0 : n.inheritFromControlPlane) !== !1 && t.ctx && await ee(t, s, e);
+      a && t.ctx && await H(t, s, a), i != null && i.onProvision && await i.onProvision(s.id), (n == null ? void 0 : n.inheritFromControlPlane) !== !1 && t.ctx && await te(t, s, e);
     },
     async beforeDelete(t, s) {
       const { accessControl: a, databaseIsolation: i } = e;
@@ -125,14 +125,18 @@ async function H(e, t, s) {
     }
   );
   let d;
-  if (u && (d = await x(
+  if (u && (d = await ee(
     e,
     a,
     l,
     c
   )), r && e.ctx) {
     const o = e.ctx.var.user;
-    if (o != null && o.sub)
+    if (o != null && o.sub && !await x(
+      e,
+      a,
+      o.sub
+    ))
       try {
         await e.adapters.userOrganizations.create(a, {
           user_id: o.sub,
@@ -144,10 +148,10 @@ async function H(e, t, s) {
           f.id
           // organizationId
         );
-      } catch (p) {
+      } catch (g) {
         console.warn(
           `Failed to add creator ${o.sub} to organization ${f.id}:`,
-          p
+          g
         );
       }
   }
@@ -157,14 +161,33 @@ async function H(e, t, s) {
     `Would grant permissions ${i.join(", ")} to organization ${f.id}`
   );
 }
-async function x(e, t, s, a) {
+async function x(e, t, s) {
+  const a = await e.adapters.userRoles.list(
+    t,
+    s,
+    void 0,
+    ""
+    // Empty string for global roles
+  );
+  for (const i of a)
+    if ((await e.adapters.rolePermissions.list(
+      t,
+      i.id,
+      { per_page: 1e3 }
+    )).some(
+      (l) => l.permission_name === "admin:organizations"
+    ))
+      return !0;
+  return !1;
+}
+async function ee(e, t, s, a) {
   const n = (await e.adapters.roles.list(t, {})).roles.find((r) => r.name === s);
   if (n)
     return n.id;
   const u = await e.adapters.roles.create(t, {
     name: s,
     description: a
-  }), l = G, c = W.map((r) => ({
+  }), l = W, c = B.map((r) => ({
     role_id: u.id,
     resource_server_identifier: l,
     permission_name: r.value
@@ -175,7 +198,7 @@ async function x(e, t, s, a) {
     c
   ), u.id;
 }
-async function ee(e, t, s) {
+async function te(e, t, s) {
   const { accessControl: a, settingsInheritance: i } = s;
   if (!a)
     return;
@@ -211,7 +234,7 @@ async function ee(e, t, s) {
     t.id
   )), Object.keys(u).length > 0 && await e.adapters.tenants.update(t.id, u);
 }
-function te(e) {
+function ae(e) {
   const {
     controlPlaneTenantId: t,
     getChildTenantIds: s,
@@ -244,25 +267,25 @@ function te(e) {
             options: r.options
           }, is_system: !0 };
           if (f === "create") {
-            const T = await u(
+            const A = await u(
               p,
               o,
               r.identifier
             );
-            T && T.id ? await p.resourceServers.update(
+            A && A.id ? await p.resourceServers.update(
               o,
-              T.id,
+              A.id,
               h
             ) : await p.resourceServers.create(o, h);
           } else {
-            const T = await u(
+            const A = await u(
               p,
               o,
               r.identifier
             );
-            T && T.id ? await p.resourceServers.update(
+            A && A.id ? await p.resourceServers.update(
               o,
-              T.id,
+              A.id,
               h
             ) : await p.resourceServers.create(o, h);
           }
@@ -307,7 +330,7 @@ function te(e) {
     }
   };
 }
-function ae(e) {
+function ne(e) {
   const {
     controlPlaneTenantId: t,
     getControlPlaneAdapters: s,
@@ -365,7 +388,7 @@ function ae(e) {
     }
   };
 }
-function ne(e) {
+function re(e) {
   const {
     controlPlaneTenantId: t,
     getChildTenantIds: s,
@@ -426,7 +449,7 @@ function ne(e) {
     }
   };
 }
-function re(e) {
+function se(e) {
   const {
     controlPlaneTenantId: t,
     getControlPlaneAdapters: s,
@@ -451,11 +474,11 @@ function re(e) {
                 const h = n ? n(g, c.id) : {
                   name: g.name,
                   description: g.description
-                }, T = await f.roles.create(c.id, {
+                }, A = await f.roles.create(c.id, {
                   ...h,
                   is_system: !0
                 });
-                o.set(g.id, T.id);
+                o.set(g.id, A.id);
               } catch (h) {
                 console.error(
                   `Failed to sync role "${g.name}" to new tenant "${c.id}":`,
@@ -474,10 +497,10 @@ function re(e) {
                 h.length > 0 && await f.rolePermissions.assign(
                   c.id,
                   g,
-                  h.map((T) => ({
+                  h.map((A) => ({
                     role_id: g,
-                    resource_server_identifier: T.resource_server_identifier,
-                    permission_name: T.permission_name
+                    resource_server_identifier: A.resource_server_identifier,
+                    permission_name: A.permission_name
                   }))
                 );
               } catch (h) {
@@ -495,7 +518,7 @@ function re(e) {
     }
   };
 }
-function j(e, t) {
+function O(e, t) {
   const s = new Q();
   return s.openapi(
     M({
@@ -515,7 +538,7 @@ function j(e, t) {
           content: {
             "application/json": {
               schema: P.object({
-                tenants: P.array(O),
+                tenants: P.array(q),
                 start: P.number().optional(),
                 limit: P.number().optional(),
                 length: P.number().optional()
@@ -527,26 +550,26 @@ function j(e, t) {
       }
     }),
     async (a) => {
-      var p, g, h, T;
+      var p, g, h, A;
       const i = a.req.valid("query"), { page: n, per_page: u, include_totals: l, q: c } = i, r = a.var.user, f = ((r == null ? void 0 : r.scope) || "").split(" "), d = f.includes("auth:read");
       if (console.log("User scopes:", f, "hasAuthRead:", d), d) {
-        const b = await a.env.data.tenants.list({
+        const C = await a.env.data.tenants.list({
           page: n,
           per_page: u,
           include_totals: l,
           q: c
         });
         return l ? a.json({
-          tenants: b.tenants,
-          start: ((p = b.totals) == null ? void 0 : p.start) ?? 0,
-          limit: ((g = b.totals) == null ? void 0 : g.limit) ?? u,
-          length: b.tenants.length
-        }) : a.json({ tenants: b.tenants });
+          tenants: C.tenants,
+          start: ((p = C.totals) == null ? void 0 : p.start) ?? 0,
+          limit: ((g = C.totals) == null ? void 0 : g.limit) ?? u,
+          length: C.tenants.length
+        }) : a.json({ tenants: C.tenants });
       }
       if (e.accessControl && (r != null && r.sub)) {
-        const b = e.accessControl.controlPlaneTenantId, $ = (await S(
+        const C = e.accessControl.controlPlaneTenantId, $ = (await S(
           (R) => a.env.data.userOrganizations.listUserOrganizations(
-            b,
+            C,
             r.sub,
             R
           ),
@@ -567,18 +590,18 @@ function j(e, t) {
             limit: v,
             length: z
           }) : a.json({ tenants: [] });
-        const y = m.map((R) => `id:${R}`).join(" OR "), _ = c ? `(${y}) AND (${c})` : y, A = await a.env.data.tenants.list({
+        const y = m.map((R) => `id:${R}`).join(" OR "), _ = c ? `(${y}) AND (${c})` : y, b = await a.env.data.tenants.list({
           q: _,
           per_page: v,
           include_totals: !1
           // We calculate totals from accessibleTenantIds
         });
         return l ? a.json({
-          tenants: A.tenants,
+          tenants: b.tenants,
           start: w,
           limit: v,
           length: z
-        }) : a.json({ tenants: A.tenants });
+        }) : a.json({ tenants: b.tenants });
       }
       const o = await a.env.data.tenants.list({
         page: n,
@@ -589,7 +612,7 @@ function j(e, t) {
       return l ? a.json({
         tenants: o.tenants,
         start: ((h = o.totals) == null ? void 0 : h.start) ?? 0,
-        limit: ((T = o.totals) == null ? void 0 : T.limit) ?? u,
+        limit: ((A = o.totals) == null ? void 0 : A.limit) ?? u,
         length: o.tenants.length
       }) : a.json({ tenants: o.tenants });
     }
@@ -616,7 +639,7 @@ function j(e, t) {
         201: {
           content: {
             "application/json": {
-              schema: O
+              schema: q
             }
           },
           description: "Tenant created"
@@ -633,7 +656,7 @@ function j(e, t) {
       var c, r;
       const i = a.var.user;
       if (!(i != null && i.sub))
-        throw new C(401, {
+        throw new T(401, {
           message: "Authentication required to create tenants"
         });
       let n = a.req.valid("json");
@@ -678,11 +701,11 @@ function j(e, t) {
       if (e.accessControl) {
         const r = a.var.user, f = e.accessControl.controlPlaneTenantId;
         if (!(r != null && r.sub))
-          throw new C(401, {
+          throw new T(401, {
             message: "Authentication required"
           });
         if (i === f)
-          throw new C(403, {
+          throw new T(403, {
             message: "Cannot delete the control plane"
           });
         if (!(await S(
@@ -693,12 +716,12 @@ function j(e, t) {
           ),
           "organizations"
         )).some((p) => p.name === i))
-          throw new C(403, {
+          throw new T(403, {
             message: "Access denied to this tenant"
           });
       }
       if (!await a.env.data.tenants.get(i))
-        throw new C(404, {
+        throw new T(404, {
           message: "Tenant not found"
         });
       const u = {
@@ -709,7 +732,7 @@ function j(e, t) {
     }
   ), s;
 }
-function se(e) {
+function ie(e) {
   const t = [
     {
       pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -725,7 +748,7 @@ function se(e) {
   }
   return null;
 }
-async function ie(e, t, s) {
+async function oe(e, t, s) {
   try {
     switch (s.type) {
       case "resource_server": {
@@ -747,37 +770,37 @@ async function ie(e, t, s) {
     return !1;
   }
 }
-function oe(e) {
+function ce(e) {
   return {
     resource_server: "resource server",
     role: "role",
     connection: "connection"
   }[e];
 }
-function ce() {
+function le() {
   return async (e, t) => {
     if (!["PATCH", "PUT", "DELETE"].includes(e.req.method))
       return t();
-    const s = se(e.req.path);
+    const s = ie(e.req.path);
     if (!s)
       return t();
     const a = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
     if (!a)
       return t();
-    if (await ie(e.env.data, a, s))
-      throw new C(403, {
-        message: `This ${oe(s.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
+    if (await oe(e.env.data, a, s))
+      throw new T(403, {
+        message: `This ${ce(s.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return t();
   };
 }
-function le(e) {
+function de(e) {
   return async (t, s) => {
     if (!e.accessControl)
       return s();
     const a = t.var.tenant_id, i = t.var.organization_id;
     if (!a)
-      throw new C(400, {
+      throw new T(400, {
         message: "Tenant ID not found in request"
       });
     if (!Y(
@@ -785,13 +808,13 @@ function le(e) {
       a,
       e.accessControl.controlPlaneTenantId
     ))
-      throw new C(403, {
+      throw new T(403, {
         message: `Access denied to tenant ${a}`
       });
     return s();
   };
 }
-function de(e) {
+function ue(e) {
   return async (t, s) => {
     if (!e.subdomainRouting)
       return s();
@@ -820,19 +843,19 @@ function de(e) {
       } catch {
       }
     if (!c)
-      throw new C(404, {
+      throw new T(404, {
         message: `Tenant not found for subdomain: ${l}`
       });
     return t.set("tenant_id", c), s();
   };
 }
-function ue(e) {
+function fe(e) {
   return async (t, s) => {
     if (!e.databaseIsolation)
       return s();
     const a = t.var.tenant_id;
     if (!a)
-      throw new C(400, {
+      throw new T(400, {
         message: "Tenant ID not found in request"
       });
     try {
@@ -842,7 +865,7 @@ function ue(e) {
       throw console.error(
         `Failed to resolve database for tenant ${a}:`,
         i
-      ), new C(500, {
+      ), new T(500, {
         message: "Failed to resolve tenant database"
       });
     }
@@ -850,13 +873,13 @@ function ue(e) {
   };
 }
 function N(e) {
-  const t = de(e), s = le(e), a = ue(e);
+  const t = ue(e), s = de(e), a = fe(e);
   return async (i, n) => (await t(i, async () => {
   }), await s(i, async () => {
   }), await a(i, async () => {
   }), n());
 }
-function ge(e) {
+function _e(e) {
   const t = I(e);
   return {
     name: "multi-tenancy",
@@ -868,7 +891,7 @@ function ge(e) {
     routes: [
       {
         path: "/management",
-        handler: j(e, t)
+        handler: O(e, t)
       }
     ],
     // Called when plugin is registered
@@ -889,19 +912,19 @@ function I(e) {
     tenants: a
   };
 }
-function fe(e) {
+function pe(e) {
   const t = new U(), s = I(e);
-  return t.route("/tenants", j(e, s)), t;
+  return t.route("/tenants", O(e, s)), t;
 }
-function _e(e) {
+function Ae(e) {
   return {
     hooks: I(e),
     middleware: N(e),
-    app: fe(e),
+    app: pe(e),
     config: e
   };
 }
-function Te(e) {
+function be(e) {
   const {
     controlPlaneTenantId: t = "control_plane",
     syncResourceServers: s = !0,
@@ -919,7 +942,7 @@ function Te(e) {
     }
   }, c = I(l);
   let r, f;
-  s && (r = te({
+  s && (r = ae({
     controlPlaneTenantId: t,
     getChildTenantIds: async () => (await S(
       (m) => e.dataAdapter.tenants.list(m),
@@ -927,13 +950,13 @@ function Te(e) {
       { cursorField: "id", pageSize: 100 }
     )).filter((m) => m.id !== t).map((m) => m.id),
     getAdapters: async (w) => e.dataAdapter
-  }), f = ae({
+  }), f = ne({
     controlPlaneTenantId: t,
     getControlPlaneAdapters: async () => e.dataAdapter,
     getAdapters: async (w) => e.dataAdapter
   }));
   let d, o;
-  a && (d = ne({
+  a && (d = re({
     controlPlaneTenantId: t,
     getChildTenantIds: async () => (await S(
       (m) => e.dataAdapter.tenants.list(m),
@@ -941,7 +964,7 @@ function Te(e) {
       { cursorField: "id", pageSize: 100 }
     )).filter((m) => m.id !== t).map((m) => m.id),
     getAdapters: async (w) => e.dataAdapter
-  }), o = re({
+  }), o = se({
     controlPlaneTenantId: t,
     getControlPlaneAdapters: async () => e.dataAdapter,
     getAdapters: async (w) => e.dataAdapter,
@@ -952,21 +975,21 @@ function Te(e) {
     if (w)
       try {
         await w(...y);
-      } catch (A) {
-        _.push(A instanceof Error ? A : new Error(String(A)));
+      } catch (b) {
+        _.push(b instanceof Error ? b : new Error(String(b)));
       }
     if (m)
       try {
         await m(...y);
-      } catch (A) {
-        _.push(A instanceof Error ? A : new Error(String(A)));
+      } catch (b) {
+        _.push(b instanceof Error ? b : new Error(String(b)));
       }
     if (_.length === 1)
       throw _[0];
     if (_.length > 1)
       throw new AggregateError(
         _,
-        `Multiple hook errors: ${_.map((A) => A.message).join("; ")}`
+        `Multiple hook errors: ${_.map((b) => b.message).join("; ")}`
       );
   }, g = async (w, ...m) => {
     const y = [];
@@ -974,9 +997,9 @@ function Te(e) {
       if (_)
         try {
           await _(...m);
-        } catch (A) {
+        } catch (b) {
           y.push(
-            A instanceof Error ? A : new Error(String(A))
+            b instanceof Error ? b : new Error(String(b))
           );
         }
     if (y.length === 1)
@@ -1065,7 +1088,7 @@ function Te(e) {
         );
       }
     } : n == null ? void 0 : n.tenants
-  }, T = {
+  }, A = {
     ...c,
     tenants: f || o ? {
       ...c.tenants,
@@ -1081,20 +1104,20 @@ function Te(e) {
         );
       }
     } : c.tenants
-  }, b = j(
+  }, C = O(
     l,
-    T
-  ), q = L({
+    A
+  ), j = L({
     ...u,
     entityHooks: h,
     // Register tenant routes via the extension mechanism
     // This ensures they go through the full middleware chain (caching, tenant, auth, entity hooks)
     managementApiExtensions: [
       ...u.managementApiExtensions || [],
-      { path: "/tenants", router: b }
+      { path: "/tenants", router: C }
     ]
-  }), { app: $, managementApp: z, ...F } = q, v = new U();
-  return v.onError((w, m) => w instanceof C ? w.getResponse() : (console.error(w), m.json({ message: "Internal Server Error" }, 500))), v.use("/api/v2/*", ce()), v.route("/", $), {
+  }), { app: $, managementApp: z, ...F } = j, v = new U();
+  return v.onError((w, m) => w instanceof T ? w.getResponse() : (console.error(w), m.json({ message: "Internal Server Error" }, 500))), v.use("/api/v2/*", le()), v.route("/", $), {
     app: v,
     managementApp: z,
     ...F,
@@ -1103,26 +1126,26 @@ function Te(e) {
   };
 }
 export {
-  ve as MANAGEMENT_API_SCOPES,
+  Ce as MANAGEMENT_API_SCOPES,
   X as createAccessControlHooks,
-  le as createAccessControlMiddleware,
+  de as createAccessControlMiddleware,
   Z as createDatabaseHooks,
-  ue as createDatabaseMiddleware,
-  fe as createMultiTenancy,
+  fe as createDatabaseMiddleware,
+  pe as createMultiTenancy,
   I as createMultiTenancyHooks,
   N as createMultiTenancyMiddleware,
-  ge as createMultiTenancyPlugin,
-  ce as createProtectSyncedMiddleware,
+  _e as createMultiTenancyPlugin,
+  le as createProtectSyncedMiddleware,
   k as createProvisioningHooks,
-  te as createResourceServerSyncHooks,
-  ne as createRoleSyncHooks,
-  de as createSubdomainMiddleware,
-  ae as createTenantResourceServerSyncHooks,
-  re as createTenantRoleSyncHooks,
-  j as createTenantsOpenAPIRouter,
-  be as fetchAll,
-  Te as init,
-  Pe as seed,
-  _e as setupMultiTenancy,
+  ae as createResourceServerSyncHooks,
+  re as createRoleSyncHooks,
+  ue as createSubdomainMiddleware,
+  ne as createTenantResourceServerSyncHooks,
+  se as createTenantRoleSyncHooks,
+  O as createTenantsOpenAPIRouter,
+  Pe as fetchAll,
+  be as init,
+  Se as seed,
+  Ae as setupMultiTenancy,
   Y as validateTenantAccess
 };

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "13.11.0",
+  "version": "13.12.0",
   "description": "Multi-tenancy support for AuthHero with organization-based access control and per-tenant database isolation",
   "files": [
     "dist"
@@ -42,7 +42,7 @@
   "dependencies": {
     "zod": "^3.24.0",
     "@authhero/adapter-interfaces": "0.114.0",
-    "authhero": "1.1.0"
+    "authhero": "1.2.0"
   },
   "peerDependencies": {
     "@hono/zod-openapi": "^0.19.10",