@authhero/multi-tenancy 13.14.0 → 13.16.0

package/README.md

@@ -117,6 +117,52 @@ const config: AuthHeroConfig = {
 };
 ```
 
+## Migration Guide
+
+### Migrating from Legacy Settings Inheritance
+
+If you're using the deprecated settings inheritance functions, migrate to the new runtime fallback API:
+
+#### Before (Deprecated)
+
+```typescript
+import {
+  withSettingsInheritance,
+  SettingsInheritanceConfig,
+} from "@authhero/multi-tenancy";
+
+const config: SettingsInheritanceConfig = {
+  controlPlaneTenantId: "main",
+  controlPlaneClientId: "main-client",
+};
+
+const adapters = withSettingsInheritance(baseAdapters, config);
+```
+
+#### After (Current)
+
+```typescript
+import {
+  withRuntimeFallback,
+  RuntimeFallbackConfig,
+} from "@authhero/multi-tenancy";
+
+const config: RuntimeFallbackConfig = {
+  controlPlaneTenantId: "main",
+  controlPlaneClientId: "main-client",
+};
+
+const adapters = withRuntimeFallback(baseAdapters, config);
+```
+
+**What changed:**
+
+- `withSettingsInheritance` → `withRuntimeFallback`
+- `createSettingsInheritanceAdapter` → `createRuntimeFallbackAdapter`
+- `SettingsInheritanceConfig` → `RuntimeFallbackConfig`
+
+The functionality remains identical - this is purely a naming change to better reflect that settings are inherited at runtime without copying data between tenants.
+
 ## License
 
 MIT

package/dist/multi-tenancy.cjs

@@ -1 +1 @@
-"use strict";var ue=Object.defineProperty;var me=(t,e,n)=>e in t?ue(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var B=(t,e,n)=>me(t,typeof e!="symbol"?e+"":e,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const x=require("hono"),I=require("authhero"),S=require("@hono/zod-openapi"),F=require("@authhero/adapter-interfaces");var P=class extends Error{constructor(e=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});B(this,"res");B(this,"status");this.res=n==null?void 0:n.res,this.status=e}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function ee(t){const{controlPlaneTenantId:e,requireOrganizationMatch:n=!0}=t;return{async onTenantAccessValidation(a,r){if(r===e)return!0;if(n){const i=a.var.org_name,l=a.var.organization_id,o=i||l;return o?o===r:!1}return!0}}}function te(t,e,n,a){if(e===n)return!0;const r=a||t;return r?r===e:!1}function ne(t){return{async resolveDataAdapters(e){try{return await t.getAdapters(e)}catch(n){console.error(`Failed to resolve data adapters for tenant ${e}:`,n);return}}}}function re(t){return{async beforeCreate(e,n){return!n.audience&&n.id?{...n,audience:I.getTenantAudience(n.id)}:n},async afterCreate(e,n){const{accessControl:a,databaseIsolation:r,settingsInheritance:i}=t;a&&e.ctx&&await pe(e,n,a),r!=null&&r.onProvision&&await r.onProvision(n.id),(i==null?void 0:i.inheritFromControlPlane)!==!1&&e.ctx&&await he(e,n,t)},async beforeDelete(e,n){const{accessControl:a,databaseIsolation:r}=t;if(a)try{const l=(await e.adapters.organizations.list(a.controlPlaneTenantId)).organizations.find(o=>o.name===n);l&&await e.adapters.organizations.remove(a.controlPlaneTenantId,l.id)}catch(i){console.warn(`Failed to remove organization for tenant ${n}:`,i)}if(r!=null&&r.onDeprovision)try{await r.onDeprovision(n)}catch(i){console.warn(`Failed to deprovision database for tenant ${n}:`,i)}}}}async function pe(t,e,n){const{controlPlaneTenantId:a,defaultPermissions:r,defaultRoles:i,issuer:l,adminRoleName:o="Tenant Admin",adminRoleDescription:m="Full access to all tenant management operations",addCreatorToOrganization:s=!0}=n,c=await t.adapters.organizations.create(a,{name:e.id,display_name:e.friendly_name||e.id});let d;if(l&&(d=await we(t,a,o,m)),s&&t.ctx){const u=t.ctx.var.user;if(u!=null&&u.sub&&!await fe(t,a,u.sub))try{await t.adapters.userOrganizations.create(a,{user_id:u.sub,organization_id:c.id}),d&&await t.adapters.userRoles.create(a,u.sub,d,c.id)}catch(f){console.warn(`Failed to add creator ${u.sub} to organization ${c.id}:`,f)}}i&&i.length>0&&console.log(`Would assign roles ${i.join(", ")} to organization ${c.id}`),r&&r.length>0&&console.log(`Would grant permissions ${r.join(", ")} to organization ${c.id}`)}async function fe(t,e,n){const a=await t.adapters.userRoles.list(e,n,void 0,"");for(const r of a)if((await t.adapters.rolePermissions.list(e,r.id,{per_page:1e3})).some(o=>o.permission_name==="admin:organizations"))return!0;return!1}async function we(t,e,n,a){const i=(await t.adapters.roles.list(e,{})).roles.find(s=>s.name===n);if(i)return i.id;const l=await t.adapters.roles.create(e,{name:n,description:a}),o=I.MANAGEMENT_API_AUDIENCE,m=I.MANAGEMENT_API_SCOPES.map(s=>({role_id:l.id,resource_server_identifier:o,permission_name:s.value}));return await t.adapters.rolePermissions.assign(e,l.id,m),l.id}async function he(t,e,n){const{accessControl:a,settingsInheritance:r}=n;if(!a)return;const i=await t.adapters.tenants.get(a.controlPlaneTenantId);if(!i)return;let l={...i};const o=["id","created_at","updated_at","friendly_name","audience","sender_email","sender_name"];for(const m of o)delete l[m];if(r!=null&&r.inheritedKeys){const m={};for(const s of r.inheritedKeys)s in i&&!o.includes(s)&&(m[s]=i[s]);l=m}if(r!=null&&r.excludedKeys)for(const m of r.excludedKeys)delete l[m];r!=null&&r.transformSettings&&(l=r.transformSettings(l,e.id)),Object.keys(l).length>0&&await t.adapters.tenants.update(e.id,l)}const ge=["client_id","client_secret","app_secret","kid","team_id","twilio_sid","twilio_token"];function G(t,e,n=()=>!0){const{controlPlaneTenantId:a,getChildTenantIds:r,getAdapters:i}=t,l=new Map;async function o(c,d,u){return(await e(c).list(d,{q:`name:${u}`,per_page:1}))[0]??null}async function m(c){const d=await r(),u=e(await i(a));await Promise.all(d.map(async p=>{try{const f=await i(p),w=e(f),g={...u.transform(c),is_system:!0},v=await o(f,p,c.name),y=v?w.getId(v):void 0;if(v&&y){const C=w.preserveOnUpdate?w.preserveOnUpdate(v,g):g;await w.update(p,y,C)}else await w.create(p,g)}catch(f){console.error(`Failed to sync ${u.listKey} "${c.name}" to tenant "${p}":`,f)}}))}async function s(c){const d=await r();await Promise.all(d.map(async u=>{try{const p=await i(u),f=e(p),w=await o(p,u,c),h=w?f.getId(w):void 0;w&&h&&await f.remove(u,h)}catch(p){console.error(`Failed to delete entity "${c}" from tenant "${u}":`,p)}}))}return{afterCreate:async(c,d)=>{c.tenantId===a&&n(d)&&await m(d)},afterUpdate:async(c,d,u)=>{c.tenantId===a&&n(u)&&await m(u)},beforeDelete:async(c,d)=>{if(c.tenantId!==a)return;const p=await e(c.adapters).get(c.tenantId,d);p&&n(p)&&l.set(d,p)},afterDelete:async(c,d)=>{if(c.tenantId!==a)return;const u=l.get(d);u&&(l.delete(d),await s(u.name))}}}function L(t,e,n=()=>!0){const{controlPlaneTenantId:a,getControlPlaneAdapters:r,getAdapters:i}=t;return{async afterCreate(l,o){if(o.id!==a)try{const m=await r(),s=await i(o.id),c=e(m),d=e(s),u=await I.fetchAll(p=>c.listPaginated(a,p),c.listKey,{cursorField:"id",pageSize:100});await Promise.all(u.filter(p=>n(p)).map(async p=>{try{const f=c.transform(p);await d.create(o.id,{...f,is_system:!0})}catch(f){console.error(`Failed to sync entity to new tenant "${o.id}":`,f)}}))}catch(m){console.error(`Failed to sync entities to new tenant "${o.id}":`,m)}}}}const E=t=>({list:async(e,n)=>(await t.resourceServers.list(e,n)).resource_servers,listPaginated:(e,n)=>t.resourceServers.list(e,n),get:(e,n)=>t.resourceServers.get(e,n),create:(e,n)=>t.resourceServers.create(e,n),update:(e,n,a)=>t.resourceServers.update(e,n,a),remove:(e,n)=>t.resourceServers.remove(e,n),listKey:"resource_servers",getId:e=>e.id,transform:e=>({name:e.name,identifier:e.identifier,scopes:e.scopes,signing_alg:e.signing_alg,token_lifetime:e.token_lifetime,token_lifetime_for_web:e.token_lifetime_for_web})}),H=t=>({list:async(e,n)=>(await t.roles.list(e,n)).roles,listPaginated:(e,n)=>t.roles.list(e,n),get:(e,n)=>t.roles.get(e,n),create:(e,n)=>t.roles.create(e,n),update:(e,n,a)=>t.roles.update(e,n,a),remove:(e,n)=>t.roles.remove(e,n),listKey:"roles",getId:e=>e.id,transform:e=>({name:e.name,description:e.description})}),k=t=>({list:async(e,n)=>(await t.connections.list(e,n)).connections,listPaginated:(e,n)=>t.connections.list(e,n),get:(e,n)=>t.connections.get(e,n),create:(e,n)=>t.connections.create(e,n),update:(e,n,a)=>t.connections.update(e,n,a),remove:(e,n)=>t.connections.remove(e,n),listKey:"connections",getId:e=>e.id,transform:e=>{const n=e.options?{...e.options}:{};for(const a of ge)delete n[a];return{name:e.name,display_name:e.display_name,strategy:e.strategy,options:n,response_type:e.response_type,response_mode:e.response_mode,is_domain_connection:e.is_domain_connection,show_as_button:e.show_as_button,metadata:e.metadata}},preserveOnUpdate:(e,n)=>{const a=e.options||{};return{...n,options:{...n.options,client_id:a.client_id,client_secret:a.client_secret,app_secret:a.app_secret,kid:a.kid,team_id:a.team_id,twilio_sid:a.twilio_sid,twilio_token:a.twilio_token}}}});function ae(t){const{sync:e={},filters:n={}}=t,a=e.resourceServers??!0,r=e.roles??!0,i=e.connections??!0,l=a?G(t,E,n.resourceServers):void 0,o=r?G(t,H,n.roles):void 0,m=i?G(t,k,n.connections):void 0,s=a?L(t,E,n.resourceServers):void 0,c=r?L(t,H,n.roles):void 0,d=i?L(t,k,n.connections):void 0,u=r?{async afterCreate(w,h){var g;if(h.id!==t.controlPlaneTenantId){await((g=c==null?void 0:c.afterCreate)==null?void 0:g.call(c,w,h));try{const v=await t.getControlPlaneAdapters(),y=await t.getAdapters(h.id),C=await I.fetchAll(b=>v.roles.list(t.controlPlaneTenantId,b),"roles",{cursorField:"id",pageSize:100}),M=new Map;for(const b of C.filter(_=>{var A;return((A=n.roles)==null?void 0:A.call(n,_))??!0})){const _=await p(y,h.id,b.name);_&&M.set(b.name,_.id)}for(const b of C.filter(_=>{var A;return((A=n.roles)==null?void 0:A.call(n,_))??!0})){const _=M.get(b.name);if(_)try{const A=await v.rolePermissions.list(t.controlPlaneTenantId,b.id,{});A.length>0&&await y.rolePermissions.assign(h.id,_,A.map(z=>({role_id:_,resource_server_identifier:z.resource_server_identifier,permission_name:z.permission_name})))}catch(A){console.error(`Failed to sync permissions for role "${b.name}" to tenant "${h.id}":`,A)}}}catch(v){console.error(`Failed to sync role permissions to tenant "${h.id}":`,v)}}}}:void 0;async function p(w,h,g){return(await w.roles.list(h,{q:`name:${g}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:l,roles:o,connections:m},tenantHooks:{async afterCreate(w,h){const g=[s==null?void 0:s.afterCreate,(u==null?void 0:u.afterCreate)??(c==null?void 0:c.afterCreate),d==null?void 0:d.afterCreate],v=[];for(const y of g)if(y)try{await y(w,h)}catch(C){v.push(C instanceof Error?C:new Error(String(C)))}if(v.length===1)throw v[0];if(v.length>1)throw new AggregateError(v,v.map(y=>y.message).join("; "))}}}}function N(t,e){const n=new S.OpenAPIHono;return n.openapi(S.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:F.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:S.z.object({tenants:S.z.array(F.tenantSchema),start:S.z.number().optional(),limit:S.z.number().optional(),length:S.z.number().optional()})}},description:"List of tenants"}}}),async a=>{var p,f,w,h;const r=a.req.valid("query"),{page:i,per_page:l,include_totals:o,q:m}=r,s=a.var.user,c=(s==null?void 0:s.permissions)||[];if(c.includes("auth:read")||c.includes("admin:organizations")){const g=await a.env.data.tenants.list({page:i,per_page:l,include_totals:o,q:m});return o?a.json({tenants:g.tenants,start:((p=g.totals)==null?void 0:p.start)??0,limit:((f=g.totals)==null?void 0:f.limit)??l,length:g.tenants.length}):a.json({tenants:g.tenants})}if(t.accessControl&&(s!=null&&s.sub)){const g=t.accessControl.controlPlaneTenantId,y=(await I.fetchAll(O=>a.env.data.userOrganizations.listUserOrganizations(g,s.sub,O),"organizations")).map(O=>O.name);if(y.length===0)return o?a.json({tenants:[],start:0,limit:l??50,length:0}):a.json({tenants:[]});const C=y.length,M=i??0,b=l??50,_=M*b,A=y.slice(_,_+b);if(A.length===0)return o?a.json({tenants:[],start:_,limit:b,length:C}):a.json({tenants:[]});const z=A.map(O=>`id:${O}`).join(" OR "),q=m?`(${z}) AND (${m})`:z,R=await a.env.data.tenants.list({q,per_page:b,include_totals:!1});return o?a.json({tenants:R.tenants,start:_,limit:b,length:C}):a.json({tenants:R.tenants})}const u=await a.env.data.tenants.list({page:i,per_page:l,include_totals:o,q:m});return o?a.json({tenants:u.tenants,start:((w=u.totals)==null?void 0:w.start)??0,limit:((h=u.totals)==null?void 0:h.limit)??l,length:u.tenants.length}):a.json({tenants:u.tenants})}),n.openapi(S.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:F.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:F.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async a=>{var m,s;const r=a.var.user;if(!(r!=null&&r.sub))throw new P(401,{message:"Authentication required to create tenants"});let i=a.req.valid("json");const l={adapters:a.env.data,ctx:a};(m=e.tenants)!=null&&m.beforeCreate&&(i=await e.tenants.beforeCreate(l,i));const o=await a.env.data.tenants.create(i);return(s=e.tenants)!=null&&s.afterCreate&&await e.tenants.afterCreate(l,o),a.json(o,201)}),n.openapi(S.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:S.z.object({id:S.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async a=>{var o,m;const{id:r}=a.req.valid("param");if(t.accessControl){const s=a.var.user,c=t.accessControl.controlPlaneTenantId;if(!(s!=null&&s.sub))throw new P(401,{message:"Authentication required"});if(r===c)throw new P(403,{message:"Cannot delete the control plane"});if(!(await I.fetchAll(p=>a.env.data.userOrganizations.listUserOrganizations(c,s.sub,p),"organizations")).some(p=>p.name===r))throw new P(403,{message:"Access denied to this tenant"})}if(!await a.env.data.tenants.get(r))throw new P(404,{message:"Tenant not found"});const l={adapters:a.env.data,ctx:a};return(o=e.tenants)!=null&&o.beforeDelete&&await e.tenants.beforeDelete(l,r),await a.env.data.tenants.remove(r),(m=e.tenants)!=null&&m.afterDelete&&await e.tenants.afterDelete(l,r),a.body(null,204)}),n}function ve(t){const e=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:a}of e){const r=t.match(n);if(r&&r[1])return{type:a,id:r[1]}}return null}async function ye(t,e,n){try{switch(n.type){case"resource_server":{const a=await t.resourceServers.get(e,n.id);return(a==null?void 0:a.is_system)===!0}case"role":{const a=await t.roles.get(e,n.id);return(a==null?void 0:a.is_system)===!0}case"connection":{const a=await t.connections.get(e,n.id);return(a==null?void 0:a.is_system)===!0}default:return!1}}catch{return!1}}function _e(t){return{resource_server:"resource server",role:"role",connection:"connection"}[t]}function se(){return async(t,e)=>{if(!["PATCH","PUT","DELETE"].includes(t.req.method))return e();const n=ve(t.req.path);if(!n)return e();const a=t.var.tenant_id||t.req.header("x-tenant-id")||t.req.header("tenant-id");if(!a)return e();if(await ye(t.env.data,a,n))throw new P(403,{message:`This ${_e(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return e()}}function oe(t){return async(e,n)=>{if(!t.accessControl)return n();const a=e.var.tenant_id,r=e.var.organization_id;if(!a)throw new P(400,{message:"Tenant ID not found in request"});if(!te(r,a,t.accessControl.controlPlaneTenantId))throw new P(403,{message:`Access denied to tenant ${a}`});return n()}}function ie(t){return async(e,n)=>{if(!t.subdomainRouting)return n();const{baseDomain:a,reservedSubdomains:r=[],resolveSubdomain:i}=t.subdomainRouting,l=e.req.header("host")||"";let o=null;if(l.endsWith(a)){const s=l.slice(0,-(a.length+1));s&&!s.includes(".")&&(o=s)}if(o&&r.includes(o)&&(o=null),!o)return t.accessControl&&e.set("tenant_id",t.accessControl.controlPlaneTenantId),n();let m=null;if(i)m=await i(o);else if(t.subdomainRouting.useOrganizations!==!1&&t.accessControl)try{const s=await e.env.data.organizations.get(t.accessControl.controlPlaneTenantId,o);s&&(m=s.id)}catch{}if(!m)throw new P(404,{message:`Tenant not found for subdomain: ${o}`});return e.set("tenant_id",m),n()}}function ce(t){return async(e,n)=>{if(!t.databaseIsolation)return n();const a=e.var.tenant_id;if(!a)throw new P(400,{message:"Tenant ID not found in request"});try{const r=await t.databaseIsolation.getAdapters(a);e.env.data=r}catch(r){throw console.error(`Failed to resolve database for tenant ${a}:`,r),new P(500,{message:"Failed to resolve tenant database"})}return n()}}function V(t){const e=ie(t),n=oe(t),a=ce(t);return async(r,i)=>(await e(r,async()=>{}),await n(r,async()=>{}),await a(r,async()=>{}),i())}function be(t){const e=j(t);return{name:"multi-tenancy",middleware:V(t),hooks:e,routes:[{path:"/management",handler:N(t,e)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),t.accessControl&&console.log(`  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`),t.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`),t.databaseIsolation&&console.log("  - Database isolation enabled")}}}function j(t){const e=t.accessControl?ee(t.accessControl):{},n=t.databaseIsolation?ne(t.databaseIsolation):{},a=re(t);return{...e,...n,tenants:a}}function le(t){const e=new x.Hono,n=j(t);return e.route("/tenants",N(t,n)),e}function Ae(t){return{hooks:j(t),middleware:V(t),app:le(t),config:t}}function Ce(t){var C,M,b,_,A,z,q,R,O,W,Q,J,X,Y,Z;const{controlPlaneTenantId:e="control_plane",sync:n,multiTenancy:a,entityHooks:r,...i}=t,l={...a,accessControl:{controlPlaneTenantId:e,requireOrganizationMatch:!1,defaultPermissions:["tenant:admin"],...a==null?void 0:a.accessControl}},o=j(l),m=((C=a==null?void 0:a.databaseIsolation)==null?void 0:C.getAdapters)??(async()=>t.dataAdapter),{entityHooks:s,tenantHooks:c}=ae({controlPlaneTenantId:e,getChildTenantIds:async()=>(await I.fetchAll(T=>t.dataAdapter.tenants.list(T),"tenants",{cursorField:"id",pageSize:100})).filter(T=>T.id!==e).map(T=>T.id),getAdapters:m,getControlPlaneAdapters:async()=>m(e),sync:n});function d(D,T){if(!(!D&&!T))return D?T?async(...de)=>{const $=[];for(const U of[D,T])try{await U(...de)}catch(K){$.push(K instanceof Error?K:new Error(String(K)))}if($.length===1)throw $[0];if($.length>1)throw new AggregateError($,$.map(U=>U.message).join("; "))}:D:T}const u={...r,resourceServers:s!=null&&s.resourceServers?{...r==null?void 0:r.resourceServers,afterCreate:d((M=r==null?void 0:r.resourceServers)==null?void 0:M.afterCreate,s.resourceServers.afterCreate),afterUpdate:d((b=r==null?void 0:r.resourceServers)==null?void 0:b.afterUpdate,s.resourceServers.afterUpdate),beforeDelete:d((_=r==null?void 0:r.resourceServers)==null?void 0:_.beforeDelete,s.resourceServers.beforeDelete),afterDelete:d((A=r==null?void 0:r.resourceServers)==null?void 0:A.afterDelete,s.resourceServers.afterDelete)}:r==null?void 0:r.resourceServers,roles:s!=null&&s.roles?{...r==null?void 0:r.roles,afterCreate:d((z=r==null?void 0:r.roles)==null?void 0:z.afterCreate,s.roles.afterCreate),afterUpdate:d((q=r==null?void 0:r.roles)==null?void 0:q.afterUpdate,s.roles.afterUpdate),beforeDelete:d((R=r==null?void 0:r.roles)==null?void 0:R.beforeDelete,s.roles.beforeDelete),afterDelete:d((O=r==null?void 0:r.roles)==null?void 0:O.afterDelete,s.roles.afterDelete)}:r==null?void 0:r.roles,connections:s!=null&&s.connections?{...r==null?void 0:r.connections,afterCreate:d((W=r==null?void 0:r.connections)==null?void 0:W.afterCreate,s.connections.afterCreate),afterUpdate:d((Q=r==null?void 0:r.connections)==null?void 0:Q.afterUpdate,s.connections.afterUpdate),beforeDelete:d((J=r==null?void 0:r.connections)==null?void 0:J.beforeDelete,s.connections.beforeDelete),afterDelete:d((X=r==null?void 0:r.connections)==null?void 0:X.afterDelete,s.connections.afterDelete)}:r==null?void 0:r.connections,tenants:c?{...r==null?void 0:r.tenants,afterCreate:d((Y=r==null?void 0:r.tenants)==null?void 0:Y.afterCreate,c.afterCreate)}:r==null?void 0:r.tenants},p={...o,tenants:c?{...o.tenants,afterCreate:d((Z=o.tenants)==null?void 0:Z.afterCreate,c.afterCreate)}:o.tenants},f=N(l,p),w=I.init({...i,entityHooks:u,managementApiExtensions:[...i.managementApiExtensions||[],{path:"/tenants",router:f}]}),{app:h,managementApp:g,...v}=w,y=new x.Hono;return y.onError((D,T)=>D instanceof P?D.getResponse():(console.error(D),T.json({message:"Internal Server Error"},500))),y.use("/api/v2/*",se()),y.route("/",h),{app:y,managementApp:g,...v,multiTenancyConfig:l,multiTenancyHooks:o}}exports.createAccessControlHooks=ee;exports.createAccessControlMiddleware=oe;exports.createDatabaseHooks=ne;exports.createDatabaseMiddleware=ce;exports.createMultiTenancy=le;exports.createMultiTenancyHooks=j;exports.createMultiTenancyMiddleware=V;exports.createMultiTenancyPlugin=be;exports.createProtectSyncedMiddleware=se;exports.createProvisioningHooks=re;exports.createSubdomainMiddleware=ie;exports.createSyncHooks=ae;exports.createTenantsOpenAPIRouter=N;exports.init=Ce;exports.setupMultiTenancy=Ae;exports.validateTenantAccess=te;Object.keys(I).forEach(t=>{t!=="default"&&!Object.prototype.hasOwnProperty.call(exports,t)&&Object.defineProperty(exports,t,{enumerable:!0,get:()=>I[t]})});
+"use strict";var me=Object.defineProperty;var pe=(t,e,n)=>e in t?me(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var G=(t,e,n)=>pe(t,typeof e!="symbol"?e+"":e,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const x=require("hono"),P=require("authhero"),I=require("@hono/zod-openapi"),D=require("@authhero/adapter-interfaces");var S=class extends Error{constructor(e=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});G(this,"res");G(this,"status");this.res=n==null?void 0:n.res,this.status=e}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function ee(t){const{controlPlaneTenantId:e,requireOrganizationMatch:n=!0}=t;return{async onTenantAccessValidation(r,a){if(a===e)return!0;if(n){const c=r.var.org_name,s=r.var.organization_id,i=c||s;return i?i===a:!1}return!0}}}function te(t,e,n,r){if(e===n)return!0;const a=r||t;return a?a===e:!1}function ne(t){return{async resolveDataAdapters(e){try{return await t.getAdapters(e)}catch(n){console.error(`Failed to resolve data adapters for tenant ${e}:`,n);return}}}}function re(t){return{async beforeCreate(e,n){return!n.audience&&n.id?{...n,audience:P.getTenantAudience(n.id)}:n},async afterCreate(e,n){const{accessControl:r,databaseIsolation:a}=t;r&&e.ctx&&await fe(e,n,r),a!=null&&a.onProvision&&await a.onProvision(n.id)},async beforeDelete(e,n){const{accessControl:r,databaseIsolation:a}=t;if(r)try{const s=(await e.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find(i=>i.name===n);s&&await e.adapters.organizations.remove(r.controlPlaneTenantId,s.id)}catch(c){console.warn(`Failed to remove organization for tenant ${n}:`,c)}if(a!=null&&a.onDeprovision)try{await a.onDeprovision(n)}catch(c){console.warn(`Failed to deprovision database for tenant ${n}:`,c)}}}}async function fe(t,e,n){const{controlPlaneTenantId:r,defaultPermissions:a,defaultRoles:c,issuer:s,adminRoleName:i="Tenant Admin",adminRoleDescription:p="Full access to all tenant management operations",addCreatorToOrganization:o=!0}=n,l=await t.adapters.organizations.create(r,{name:e.id,display_name:e.friendly_name||e.id});let u;if(s&&(u=await ge(t,r,i,p)),o&&t.ctx){const d=t.ctx.var.user;if(d!=null&&d.sub&&!await we(t,r,d.sub))try{await t.adapters.userOrganizations.create(r,{user_id:d.sub,organization_id:l.id}),u&&await t.adapters.userRoles.create(r,d.sub,u,l.id)}catch(f){console.warn(`Failed to add creator ${d.sub} to organization ${l.id}:`,f)}}c&&c.length>0&&console.log(`Would assign roles ${c.join(", ")} to organization ${l.id}`),a&&a.length>0&&console.log(`Would grant permissions ${a.join(", ")} to organization ${l.id}`)}async function we(t,e,n){const r=await t.adapters.userRoles.list(e,n,void 0,"");for(const a of r)if((await t.adapters.rolePermissions.list(e,a.id,{per_page:1e3})).some(i=>i.permission_name==="admin:organizations"))return!0;return!1}async function ge(t,e,n,r){const c=(await t.adapters.roles.list(e,{})).roles.find(o=>o.name===n);if(c)return c.id;const s=await t.adapters.roles.create(e,{name:n,description:r}),i=P.MANAGEMENT_API_AUDIENCE,p=P.MANAGEMENT_API_SCOPES.map(o=>({role_id:s.id,resource_server_identifier:i,permission_name:o.value}));return await t.adapters.rolePermissions.assign(e,s.id,p),s.id}const he=["client_id","client_secret","app_secret","kid","team_id","twilio_sid","twilio_token"];function K(t,e,n=()=>!0){const{controlPlaneTenantId:r,getChildTenantIds:a,getAdapters:c}=t,s=new Map;async function i(l,u,d){return(await e(l).list(u,{q:`name:${d}`,per_page:1}))[0]??null}async function p(l){const u=await a(),d=e(await c(r));await Promise.all(u.map(async m=>{try{const f=await c(m),w=e(f),h={...d.transform(l),is_system:!0},v=await i(f,m,l.name),_=v?w.getId(v):void 0;if(v&&_){const T=w.preserveOnUpdate?w.preserveOnUpdate(v,h):h;await w.update(m,_,T)}else await w.create(m,h)}catch(f){console.error(`Failed to sync ${d.listKey} "${l.name}" to tenant "${m}":`,f)}}))}async function o(l){const u=await a();await Promise.all(u.map(async d=>{try{const m=await c(d),f=e(m),w=await i(m,d,l),g=w?f.getId(w):void 0;w&&g&&await f.remove(d,g)}catch(m){console.error(`Failed to delete entity "${l}" from tenant "${d}":`,m)}}))}return{afterCreate:async(l,u)=>{l.tenantId===r&&n(u)&&await p(u)},afterUpdate:async(l,u,d)=>{l.tenantId===r&&n(d)&&await p(d)},beforeDelete:async(l,u)=>{if(l.tenantId!==r)return;const m=await e(l.adapters).get(l.tenantId,u);m&&n(m)&&s.set(u,m)},afterDelete:async(l,u)=>{if(l.tenantId!==r)return;const d=s.get(u);d&&(s.delete(u),await o(d.name))}}}function L(t,e,n=()=>!0){const{controlPlaneTenantId:r,getControlPlaneAdapters:a,getAdapters:c}=t;return{async afterCreate(s,i){if(i.id!==r)try{const p=await a(),o=await c(i.id),l=e(p),u=e(o),d=await P.fetchAll(m=>l.listPaginated(r,m),l.listKey,{cursorField:"id",pageSize:100});await Promise.all(d.filter(m=>n(m)).map(async m=>{try{const f=l.transform(m);await u.create(i.id,{...f,is_system:!0})}catch(f){console.error(`Failed to sync entity to new tenant "${i.id}":`,f)}}))}catch(p){console.error(`Failed to sync entities to new tenant "${i.id}":`,p)}}}}const k=t=>({list:async(e,n)=>(await t.resourceServers.list(e,n)).resource_servers,listPaginated:(e,n)=>t.resourceServers.list(e,n),get:(e,n)=>t.resourceServers.get(e,n),create:(e,n)=>t.resourceServers.create(e,n),update:(e,n,r)=>t.resourceServers.update(e,n,r),remove:(e,n)=>t.resourceServers.remove(e,n),listKey:"resource_servers",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,identifier:e.identifier,scopes:e.scopes,signing_alg:e.signing_alg,token_lifetime:e.token_lifetime,token_lifetime_for_web:e.token_lifetime_for_web})}),E=t=>({list:async(e,n)=>(await t.roles.list(e,n)).roles,listPaginated:(e,n)=>t.roles.list(e,n),get:(e,n)=>t.roles.get(e,n),create:(e,n)=>t.roles.create(e,n),update:(e,n,r)=>t.roles.update(e,n,r),remove:(e,n)=>t.roles.remove(e,n),listKey:"roles",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,description:e.description})}),H=t=>({list:async(e,n)=>(await t.connections.list(e,n)).connections,listPaginated:(e,n)=>t.connections.list(e,n),get:(e,n)=>t.connections.get(e,n),create:(e,n)=>t.connections.create(e,n),update:(e,n,r)=>t.connections.update(e,n,r),remove:(e,n)=>t.connections.remove(e,n),listKey:"connections",getId:e=>e.id,transform:e=>{const n=e.options?{...e.options}:{};for(const r of he)delete n[r];return{id:e.id,name:e.name,display_name:e.display_name,strategy:e.strategy,options:n,response_type:e.response_type,response_mode:e.response_mode,is_domain_connection:e.is_domain_connection,show_as_button:e.show_as_button,metadata:e.metadata}},preserveOnUpdate:(e,n)=>{const r=e.options||{};return{...n,options:{...n.options,client_id:r.client_id,client_secret:r.client_secret,app_secret:r.app_secret,kid:r.kid,team_id:r.team_id,twilio_sid:r.twilio_sid,twilio_token:r.twilio_token}}}});function ae(t){const{sync:e={},filters:n={}}=t,r=e.resourceServers??!0,a=e.roles??!0,c=e.connections??!0,s=r?K(t,k,n.resourceServers):void 0,i=a?K(t,E,n.roles):void 0,p=c?K(t,H,n.connections):void 0,o=r?L(t,k,n.resourceServers):void 0,l=a?L(t,E,n.roles):void 0,u=c?L(t,H,n.connections):void 0,d=a?{async afterCreate(w,g){var h;if(g.id!==t.controlPlaneTenantId){await((h=l==null?void 0:l.afterCreate)==null?void 0:h.call(l,w,g));try{const v=await t.getControlPlaneAdapters(),_=await t.getAdapters(g.id),T=await P.fetchAll(b=>v.roles.list(t.controlPlaneTenantId,b),"roles",{cursorField:"id",pageSize:100}),M=new Map;for(const b of T.filter(y=>{var A;return((A=n.roles)==null?void 0:A.call(n,y))??!0})){const y=await m(_,g.id,b.name);y&&M.set(b.name,y.id)}for(const b of T.filter(y=>{var A;return((A=n.roles)==null?void 0:A.call(n,y))??!0})){const y=M.get(b.name);if(y)try{const A=await v.rolePermissions.list(t.controlPlaneTenantId,b.id,{});A.length>0&&await _.rolePermissions.assign(g.id,y,A.map(O=>({role_id:y,resource_server_identifier:O.resource_server_identifier,permission_name:O.permission_name})))}catch(A){console.error(`Failed to sync permissions for role "${b.name}" to tenant "${g.id}":`,A)}}}catch(v){console.error(`Failed to sync role permissions to tenant "${g.id}":`,v)}}}}:void 0;async function m(w,g,h){return(await w.roles.list(g,{q:`name:${h}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:s,roles:i,connections:p},tenantHooks:{async afterCreate(w,g){const h=[o==null?void 0:o.afterCreate,(d==null?void 0:d.afterCreate)??(l==null?void 0:l.afterCreate),u==null?void 0:u.afterCreate],v=[];for(const _ of h)if(_)try{await _(w,g)}catch(T){v.push(T instanceof Error?T:new Error(String(T)))}if(v.length===1)throw v[0];if(v.length>1)throw new AggregateError(v,v.map(_=>_.message).join("; "))}}}}function N(t,e){const n=new I.OpenAPIHono;return n.openapi(I.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:D.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:I.z.object({tenants:I.z.array(D.tenantSchema),start:I.z.number().optional(),limit:I.z.number().optional(),length:I.z.number().optional()})}},description:"List of tenants"}}}),async r=>{var m,f,w,g;const a=r.req.valid("query"),{page:c,per_page:s,include_totals:i,q:p}=a,o=r.var.user,l=(o==null?void 0:o.permissions)||[];if(l.includes("auth:read")||l.includes("admin:organizations")){const h=await r.env.data.tenants.list({page:c,per_page:s,include_totals:i,q:p});return i?r.json({tenants:h.tenants,start:((m=h.totals)==null?void 0:m.start)??0,limit:((f=h.totals)==null?void 0:f.limit)??s,length:h.tenants.length}):r.json({tenants:h.tenants})}if(t.accessControl&&(o!=null&&o.sub)){const h=t.accessControl.controlPlaneTenantId,_=(await P.fetchAll(R=>r.env.data.userOrganizations.listUserOrganizations(h,o.sub,R),"organizations")).map(R=>R.name);if(_.length===0)return i?r.json({tenants:[],start:0,limit:s??50,length:0}):r.json({tenants:[]});const T=_.length,M=c??0,b=s??50,y=M*b,A=_.slice(y,y+b);if(A.length===0)return i?r.json({tenants:[],start:y,limit:b,length:T}):r.json({tenants:[]});const O=A.map(R=>`id:${R}`).join(" OR "),j=p?`(${O}) AND (${p})`:O,q=await r.env.data.tenants.list({q:j,per_page:b,include_totals:!1});return i?r.json({tenants:q.tenants,start:y,limit:b,length:T}):r.json({tenants:q.tenants})}const d=await r.env.data.tenants.list({page:c,per_page:s,include_totals:i,q:p});return i?r.json({tenants:d.tenants,start:((w=d.totals)==null?void 0:w.start)??0,limit:((g=d.totals)==null?void 0:g.limit)??s,length:d.tenants.length}):r.json({tenants:d.tenants})}),n.openapi(I.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:D.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:D.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async r=>{var p,o;const a=r.var.user;if(!(a!=null&&a.sub))throw new S(401,{message:"Authentication required to create tenants"});let c=r.req.valid("json");const s={adapters:r.env.data,ctx:r};(p=e.tenants)!=null&&p.beforeCreate&&(c=await e.tenants.beforeCreate(s,c));const i=await r.env.data.tenants.create(c);return(o=e.tenants)!=null&&o.afterCreate&&await e.tenants.afterCreate(s,i),r.json(i,201)}),n.openapi(I.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:I.z.object({id:I.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async r=>{var i,p;const{id:a}=r.req.valid("param");if(t.accessControl){const o=r.var.user,l=t.accessControl.controlPlaneTenantId;if(!(o!=null&&o.sub))throw new S(401,{message:"Authentication required"});if(a===l)throw new S(403,{message:"Cannot delete the control plane"});if(!(await P.fetchAll(m=>r.env.data.userOrganizations.listUserOrganizations(l,o.sub,m),"organizations")).some(m=>m.name===a))throw new S(403,{message:"Access denied to this tenant"})}if(!await r.env.data.tenants.get(a))throw new S(404,{message:"Tenant not found"});const s={adapters:r.env.data,ctx:r};return(i=e.tenants)!=null&&i.beforeDelete&&await e.tenants.beforeDelete(s,a),await r.env.data.tenants.remove(a),(p=e.tenants)!=null&&p.afterDelete&&await e.tenants.afterDelete(s,a),r.body(null,204)}),n}function ve(t){const e=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:r}of e){const a=t.match(n);if(a&&a[1])return{type:r,id:a[1]}}return null}async function _e(t,e,n){try{switch(n.type){case"resource_server":{const r=await t.resourceServers.get(e,n.id);return(r==null?void 0:r.is_system)===!0}case"role":{const r=await t.roles.get(e,n.id);return(r==null?void 0:r.is_system)===!0}case"connection":{const r=await t.connections.get(e,n.id);return(r==null?void 0:r.is_system)===!0}default:return!1}}catch{return!1}}function ye(t){return{resource_server:"resource server",role:"role",connection:"connection"}[t]}function se(){return async(t,e)=>{if(!["PATCH","PUT","DELETE"].includes(t.req.method))return e();const n=ve(t.req.path);if(!n)return e();const r=t.var.tenant_id||t.req.header("x-tenant-id")||t.req.header("tenant-id");if(!r)return e();if(await _e(t.env.data,r,n))throw new S(403,{message:`This ${ye(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return e()}}function V(t,e){const{controlPlaneTenantId:n,controlPlaneClientId:r}=e;return{...t,legacyClients:{...t.legacyClients,get:async a=>{var u;const c=await t.legacyClients.get(a);if(!c)return null;const s=r?await t.legacyClients.get(r):void 0,i=await t.connections.list(c.tenant.id),p=n?await t.connections.list(n):{connections:[]},o=i.connections.map(d=>{var w;const m=(w=p.connections)==null?void 0:w.find(g=>g.name===d.name);if(!(m!=null&&m.options))return d;const f=D.connectionSchema.parse({...m||{},...d});return f.options=D.connectionOptionsSchema.parse({...m.options||{},...d.options}),f}).filter(d=>d),l={...(s==null?void 0:s.tenant)||{},...c.tenant};return!c.tenant.audience&&((u=s==null?void 0:s.tenant)!=null&&u.audience)&&(l.audience=s.tenant.audience),{...c,web_origins:[...(s==null?void 0:s.web_origins)||[],...c.web_origins||[]],allowed_logout_urls:[...(s==null?void 0:s.allowed_logout_urls)||[],...c.allowed_logout_urls||[]],callbacks:[...(s==null?void 0:s.callbacks)||[],...c.callbacks||[]],connections:o,tenant:l}}},connections:{...t.connections,get:async(a,c)=>{const s=await t.connections.get(a,c);if(!s||!n)return s;const i=await t.connections.get(n,c);if(!i)return s;const p=D.connectionSchema.parse({...i,...s});return p.options=D.connectionOptionsSchema.parse({...i.options||{},...s.options}),p},list:async(a,c)=>{const s=await t.connections.list(a,c);if(!n||a===n)return s;const i=await t.connections.list(n),p=s.connections.map(o=>{var d;const l=(d=i.connections)==null?void 0:d.find(m=>m.name===o.name);if(!(l!=null&&l.options))return o;const u=D.connectionSchema.parse({...l,...o});return u.options=D.connectionOptionsSchema.parse({...l.options||{},...o.options}),u});return{...s,connections:p}}}}}function oe(t,e){return V(t,e)}const be=V,Ae=oe;function ie(t){return async(e,n)=>{if(!t.accessControl)return n();const r=e.var.tenant_id,a=e.var.organization_id;if(!r)throw new S(400,{message:"Tenant ID not found in request"});if(!te(a,r,t.accessControl.controlPlaneTenantId))throw new S(403,{message:`Access denied to tenant ${r}`});return n()}}function ce(t){return async(e,n)=>{if(!t.subdomainRouting)return n();const{baseDomain:r,reservedSubdomains:a=[],resolveSubdomain:c}=t.subdomainRouting,s=e.req.header("host")||"";let i=null;if(s.endsWith(r)){const o=s.slice(0,-(r.length+1));o&&!o.includes(".")&&(i=o)}if(i&&a.includes(i)&&(i=null),!i)return t.accessControl&&e.set("tenant_id",t.accessControl.controlPlaneTenantId),n();let p=null;if(c)p=await c(i);else if(t.subdomainRouting.useOrganizations!==!1&&t.accessControl)try{const o=await e.env.data.organizations.get(t.accessControl.controlPlaneTenantId,i);o&&(p=o.id)}catch{}if(!p)throw new S(404,{message:`Tenant not found for subdomain: ${i}`});return e.set("tenant_id",p),n()}}function le(t){return async(e,n)=>{if(!t.databaseIsolation)return n();const r=e.var.tenant_id;if(!r)throw new S(400,{message:"Tenant ID not found in request"});try{const a=await t.databaseIsolation.getAdapters(r);e.env.data=a}catch(a){throw console.error(`Failed to resolve database for tenant ${r}:`,a),new S(500,{message:"Failed to resolve tenant database"})}return n()}}function W(t){const e=ce(t),n=ie(t),r=le(t);return async(a,c)=>(await e(a,async()=>{}),await n(a,async()=>{}),await r(a,async()=>{}),c())}function Te(t){const e=F(t);return{name:"multi-tenancy",middleware:W(t),hooks:e,routes:[{path:"/management",handler:N(t,e)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),t.accessControl&&console.log(`  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`),t.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`),t.databaseIsolation&&console.log("  - Database isolation enabled")}}}function F(t){const e=t.accessControl?ee(t.accessControl):{},n=t.databaseIsolation?ne(t.databaseIsolation):{},r=re(t);return{...e,...n,tenants:r}}function de(t){const e=new x.Hono,n=F(t);return e.route("/tenants",N(t,n)),e}function Ce(t){return{hooks:F(t),middleware:W(t),app:de(t),config:t}}function Se(t){var T,M,b,y,A,O,j,q,R,Q,J,X,Y,Z;const{controlPlaneTenantId:e="control_plane",sync:n,multiTenancy:r,entityHooks:a,...c}=t,s={...r,accessControl:{controlPlaneTenantId:e,requireOrganizationMatch:!1,defaultPermissions:["tenant:admin"],...r==null?void 0:r.accessControl}},i=F(s),p=((T=r==null?void 0:r.databaseIsolation)==null?void 0:T.getAdapters)??(async()=>t.dataAdapter),{entityHooks:o,tenantHooks:l}=ae({controlPlaneTenantId:e,getChildTenantIds:async()=>(await P.fetchAll(C=>t.dataAdapter.tenants.list(C),"tenants",{cursorField:"id",pageSize:100})).filter(C=>C.id!==e).map(C=>C.id),getAdapters:p,getControlPlaneAdapters:async()=>p(e),sync:n});function u(z,C){if(!(!z&&!C))return z?C?async(...ue)=>{const $=[];for(const U of[z,C])try{await U(...ue)}catch(B){$.push(B instanceof Error?B:new Error(String(B)))}if($.length===1)throw $[0];if($.length>1)throw new AggregateError($,$.map(U=>U.message).join("; "))}:z:C}const d={...a,resourceServers:o!=null&&o.resourceServers?{...a==null?void 0:a.resourceServers,afterCreate:u((M=a==null?void 0:a.resourceServers)==null?void 0:M.afterCreate,o.resourceServers.afterCreate),afterUpdate:u((b=a==null?void 0:a.resourceServers)==null?void 0:b.afterUpdate,o.resourceServers.afterUpdate),beforeDelete:u((y=a==null?void 0:a.resourceServers)==null?void 0:y.beforeDelete,o.resourceServers.beforeDelete),afterDelete:u((A=a==null?void 0:a.resourceServers)==null?void 0:A.afterDelete,o.resourceServers.afterDelete)}:a==null?void 0:a.resourceServers,roles:o!=null&&o.roles?{...a==null?void 0:a.roles,afterCreate:u((O=a==null?void 0:a.roles)==null?void 0:O.afterCreate,o.roles.afterCreate),afterUpdate:u((j=a==null?void 0:a.roles)==null?void 0:j.afterUpdate,o.roles.afterUpdate),beforeDelete:u((q=a==null?void 0:a.roles)==null?void 0:q.beforeDelete,o.roles.beforeDelete),afterDelete:u((R=a==null?void 0:a.roles)==null?void 0:R.afterDelete,o.roles.afterDelete)}:a==null?void 0:a.roles,connections:o!=null&&o.connections?{...a==null?void 0:a.connections,afterCreate:u((Q=a==null?void 0:a.connections)==null?void 0:Q.afterCreate,o.connections.afterCreate),afterUpdate:u((J=a==null?void 0:a.connections)==null?void 0:J.afterUpdate,o.connections.afterUpdate),beforeDelete:u((X=a==null?void 0:a.connections)==null?void 0:X.beforeDelete,o.connections.beforeDelete),afterDelete:u((Y=a==null?void 0:a.connections)==null?void 0:Y.afterDelete,o.connections.afterDelete)}:a==null?void 0:a.connections,tenants:a==null?void 0:a.tenants},m={...i,tenants:l?{...i.tenants,afterCreate:u((Z=i.tenants)==null?void 0:Z.afterCreate,l.afterCreate)}:i.tenants},f=N(s,m),w=P.init({...c,entityHooks:d,managementApiExtensions:[...c.managementApiExtensions||[],{path:"/tenants",router:f}]}),{app:g,managementApp:h,...v}=w,_=new x.Hono;return _.onError((z,C)=>z instanceof S?z.getResponse():(console.error(z),C.json({message:"Internal Server Error"},500))),_.use("/api/v2/*",se()),_.route("/",g),{app:_,managementApp:h,...v,multiTenancyConfig:s,multiTenancyHooks:i}}exports.createAccessControlHooks=ee;exports.createAccessControlMiddleware=ie;exports.createDatabaseHooks=ne;exports.createDatabaseMiddleware=le;exports.createMultiTenancy=de;exports.createMultiTenancyHooks=F;exports.createMultiTenancyMiddleware=W;exports.createMultiTenancyPlugin=Te;exports.createProtectSyncedMiddleware=se;exports.createProvisioningHooks=re;exports.createRuntimeFallbackAdapter=V;exports.createSettingsInheritanceAdapter=be;exports.createSubdomainMiddleware=ce;exports.createSyncHooks=ae;exports.createTenantsOpenAPIRouter=N;exports.init=Se;exports.setupMultiTenancy=Ce;exports.validateTenantAccess=te;exports.withRuntimeFallback=oe;exports.withSettingsInheritance=Ae;Object.keys(P).forEach(t=>{t!=="default"&&!Object.prototype.hasOwnProperty.call(exports,t)&&Object.defineProperty(exports,t,{enumerable:!0,get:()=>P[t]})});