@authhero/multi-tenancy 13.5.0 → 13.6.0

package/dist/multi-tenancy.cjs

@@ -1 +1 @@
-"use strict";var W=Object.defineProperty;var G=(t,e,s)=>e in t?W(t,e,{enumerable:!0,configurable:!0,writable:!0,value:s}):t[e]=s;var M=(t,e,s)=>G(t,typeof e!="symbol"?e+"":e,s);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const R=require("hono"),C=require("authhero"),Q=require("zod"),$=require("@authhero/adapter-interfaces");function q(t){const{mainTenantId:e,requireOrganizationMatch:s=!0}=t;return{async onTenantAccessValidation(n,a){if(a===e)return!0;if(s){const c=n.var.organization_id;return c?c===a:!1}return!0}}}function D(t,e,s){return e===s?!0:t?t===e:!1}function z(t){return{async resolveDataAdapters(e){try{return await t.getAdapters(e)}catch(s){console.error(`Failed to resolve data adapters for tenant ${e}:`,s);return}}}}function F(t){return{async afterCreate(e,s){const{accessControl:n,databaseIsolation:a,settingsInheritance:c}=t;n&&e.ctx&&await L(e,s,n),a!=null&&a.onProvision&&await a.onProvision(s.id),(c==null?void 0:c.inheritFromMain)!==!1&&e.ctx&&await B(e,s,t)},async beforeDelete(e,s){const{accessControl:n,databaseIsolation:a}=t;if(n)try{const d=(await e.adapters.organizations.list(n.mainTenantId)).organizations.find(o=>o.name===s);d&&await e.adapters.organizations.remove(n.mainTenantId,d.id)}catch(c){console.warn(`Failed to remove organization for tenant ${s}:`,c)}if(a!=null&&a.onDeprovision)try{await a.onDeprovision(s)}catch(c){console.warn(`Failed to deprovision database for tenant ${s}:`,c)}}}}async function L(t,e,s){const{mainTenantId:n,defaultPermissions:a,defaultRoles:c,issuer:d,adminRoleName:o="Tenant Admin",adminRoleDescription:i="Full access to all tenant management operations",addCreatorToOrganization:r=!0}=s;await t.adapters.organizations.create(n,{id:e.id,name:e.id,display_name:e.friendly_name||e.id});let l=null;if(d&&(l=await Y(t,n,d,o,i)),r&&t.ctx){const f=t.ctx.var.user;if(f!=null&&f.sub)try{await t.adapters.userOrganizations.create(n,{user_id:f.sub,organization_id:e.id}),l&&await t.adapters.userRoles.create(n,f.sub,l,e.id)}catch(u){console.warn(`Failed to add creator ${f.sub} to organization ${e.id}:`,u)}}c&&c.length>0&&console.log(`Would assign roles ${c.join(", ")} to organization ${e.id}`),a&&a.length>0&&console.log(`Would grant permissions ${a.join(", ")} to organization ${e.id}`)}async function Y(t,e,s,n,a){const d=(await t.adapters.roles.list(e,{})).roles.find(l=>l.name===n);if(d)return d.id;const o=await t.adapters.roles.create(e,{name:n,description:a}),i=`${s}api/v2/`,r=C.MANAGEMENT_API_SCOPES.map(l=>({role_id:o.id,resource_server_identifier:i,permission_name:l.value}));return await t.adapters.rolePermissions.assign(e,o.id,r),o.id}async function B(t,e,s){const{accessControl:n,settingsInheritance:a}=s;if(!n)return;const c=await t.adapters.tenants.get(n.mainTenantId);if(!c)return;let d={...c};const o=["id","created_at","updated_at","friendly_name","audience","sender_email","sender_name"];for(const i of o)delete d[i];if(a!=null&&a.inheritedKeys){const i={};for(const r of a.inheritedKeys)r in c&&!o.includes(r)&&(i[r]=c[r]);d=i}if(a!=null&&a.excludedKeys)for(const i of a.excludedKeys)delete d[i];a!=null&&a.transformSettings&&(d=a.transformSettings(d,e.id)),Object.keys(d).length>0&&await t.adapters.tenants.update(e.id,d)}async function P(t,e,s={}){const{cursorField:n="id",sortOrder:a="asc",pageSize:c=100,maxItems:d=1e4,q:o}=s,i=[];let r,l=!0;for(;l;){let f=o||"";if(r){const w=`${n}:${a==="asc"?">":"<"}${r}`;f=f?`(${f}) AND ${w}`:w}const u={per_page:c,page:0,sort:{sort_by:n,sort_order:a},...f&&{q:f}},h=(await t(u))[e]||[];if(h.length===0)l=!1;else{i.push(...h);const _=h[h.length-1];if(_&&typeof _=="object"){const w=_[n];w!=null&&(r=String(w))}h.length<c&&(l=!1),d!==-1&&i.length>=d&&(console.warn(`fetchAll: Reached maxItems limit (${d}). There may be more items.`),l=!1)}}return i}function j(t){const{mainTenantId:e,getChildTenantIds:s,getAdapters:n,shouldSync:a=()=>!0,transformForSync:c}=t;async function d(r,l,f){return(await r.resourceServers.list(l,{q:`identifier:${f}`,per_page:1})).resource_servers[0]??null}async function o(r,l){const f=await s();await Promise.all(f.map(async u=>{try{const m=await n(u),_={...c?c(r,u):{name:r.name,identifier:r.identifier,scopes:r.scopes,signing_alg:r.signing_alg,signing_secret:r.signing_secret,token_lifetime:r.token_lifetime,token_lifetime_for_web:r.token_lifetime_for_web,skip_consent_for_verifiable_first_party_clients:r.skip_consent_for_verifiable_first_party_clients,allow_offline_access:r.allow_offline_access,verificationKey:r.verificationKey,options:r.options},is_system:!0};if(l==="create"){const w=await d(m,u,r.identifier);w&&w.id?await m.resourceServers.update(u,w.id,_):await m.resourceServers.create(u,_)}else{const w=await d(m,u,r.identifier);w&&w.id&&await m.resourceServers.update(u,w.id,_)}}catch(m){console.error(`Failed to sync resource server "${r.identifier}" to tenant "${u}":`,m)}}))}async function i(r){const l=await s();await Promise.all(l.map(async f=>{try{const u=await n(f),m=await d(u,f,r);m&&m.id&&await u.resourceServers.remove(f,m.id)}catch(u){console.error(`Failed to delete resource server "${r}" from tenant "${f}":`,u)}}))}return{afterCreate:async(r,l)=>{r.tenantId===e&&a(l)&&await o(l,"create")},afterUpdate:async(r,l,f)=>{r.tenantId===e&&a(f)&&await o(f,"update")},afterDelete:async(r,l)=>{r.tenantId===e&&await i(l)}}}function O(t){const{mainTenantId:e,getMainTenantAdapters:s,getAdapters:n,shouldSync:a=()=>!0,transformForSync:c}=t;return{async afterCreate(d,o){if(o.id!==e)try{const i=await s(),r=await n(o.id),l=await P(f=>i.resourceServers.list(e,f),"resource_servers",{cursorField:"id",pageSize:100});await Promise.all(l.filter(f=>a(f)).map(async f=>{const u=f;try{const m=c?c(u,o.id):{name:u.name,identifier:u.identifier,scopes:u.scopes,signing_alg:u.signing_alg,signing_secret:u.signing_secret,token_lifetime:u.token_lifetime,token_lifetime_for_web:u.token_lifetime_for_web,skip_consent_for_verifiable_first_party_clients:u.skip_consent_for_verifiable_first_party_clients,allow_offline_access:u.allow_offline_access,verificationKey:u.verificationKey,options:u.options};await r.resourceServers.create(o.id,{...m,is_system:!0})}catch(m){console.error(`Failed to sync resource server "${u.identifier}" to new tenant "${o.id}":`,m)}}))}catch(i){console.error(`Failed to sync resource servers to new tenant "${o.id}":`,i)}}}}var p=class extends Error{constructor(e=500,s){super(s==null?void 0:s.message,{cause:s==null?void 0:s.cause});M(this,"res");M(this,"status");this.res=s==null?void 0:s.res,this.status=e}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function S(t,e){const s=new R.Hono;return s.get("/",async n=>{var l;if(t.accessControl&&await((l=e.onTenantAccessValidation)==null?void 0:l.call(e,n,t.accessControl.mainTenantId))===!1)throw new p(403,{message:"Access denied to tenant management"});const a=$.auth0QuerySchema.parse(n.req.query()),{page:c,per_page:d,include_totals:o,q:i}=a,r=await n.env.data.tenants.list({page:c,per_page:d,include_totals:o,q:i});return o?n.json(r):n.json(r.tenants)}),s.get("/:id",async n=>{var o;const a=n.req.param("id");if(await((o=e.onTenantAccessValidation)==null?void 0:o.call(e,n,a))===!1)throw new p(403,{message:"Access denied to this tenant"});const d=await n.env.data.tenants.get(a);if(!d)throw new p(404,{message:"Tenant not found"});return n.json(d)}),s.post("/",async n=>{var a,c,d,o;try{if(t.accessControl&&await((a=e.onTenantAccessValidation)==null?void 0:a.call(e,n,t.accessControl.mainTenantId))===!1)throw new p(403,{message:"Access denied to create tenants"});let i=$.tenantInsertSchema.parse(await n.req.json());const r={adapters:n.env.data,ctx:n};(c=e.tenants)!=null&&c.beforeCreate&&(i=await e.tenants.beforeCreate(r,i));const l=await n.env.data.tenants.create(i);return(d=e.tenants)!=null&&d.afterCreate&&await e.tenants.afterCreate(r,l),n.json(l,201)}catch(i){throw i instanceof Q.z.ZodError?new p(400,{message:"Validation error",cause:i}):i instanceof Error&&("code"in i&&i.code==="SQLITE_CONSTRAINT_PRIMARYKEY"||(o=i.message)!=null&&o.includes("UNIQUE constraint failed"))?new p(409,{message:"Tenant with this ID already exists"}):i}}),s.patch("/:id",async n=>{var m,h,_;const a=n.req.param("id");if(await((m=e.onTenantAccessValidation)==null?void 0:m.call(e,n,a))===!1)throw new p(403,{message:"Access denied to update this tenant"});const d=$.tenantInsertSchema.partial().parse(await n.req.json()),{id:o,...i}=d;if(!await n.env.data.tenants.get(a))throw new p(404,{message:"Tenant not found"});const l={adapters:n.env.data,ctx:n};let f=i;(h=e.tenants)!=null&&h.beforeUpdate&&(f=await e.tenants.beforeUpdate(l,a,i)),await n.env.data.tenants.update(a,f);const u=await n.env.data.tenants.get(a);if(!u)throw new p(404,{message:"Tenant not found after update"});return(_=e.tenants)!=null&&_.afterUpdate&&await e.tenants.afterUpdate(l,u),n.json(u)}),s.delete("/:id",async n=>{var o,i,r;const a=n.req.param("id");if(t.accessControl&&a===t.accessControl.mainTenantId)throw new p(400,{message:"Cannot delete the main tenant"});if(t.accessControl&&await((o=e.onTenantAccessValidation)==null?void 0:o.call(e,n,t.accessControl.mainTenantId))===!1)throw new p(403,{message:"Access denied to delete tenants"});if(!await n.env.data.tenants.get(a))throw new p(404,{message:"Tenant not found"});const d={adapters:n.env.data,ctx:n};return(i=e.tenants)!=null&&i.beforeDelete&&await e.tenants.beforeDelete(d,a),await n.env.data.tenants.remove(a),(r=e.tenants)!=null&&r.afterDelete&&await e.tenants.afterDelete(d,a),n.body(null,204)}),s}function Z(t){const e=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:s,type:n}of e){const a=t.match(s);if(a&&a[1])return{type:n,id:a[1]}}return null}async function J(t,e,s){try{switch(s.type){case"resource_server":{const n=await t.resourceServers.get(e,s.id);return(n==null?void 0:n.is_system)===!0}case"role":{const n=await t.roles.get(e,s.id);return(n==null?void 0:n.is_system)===!0}case"connection":{const n=await t.connections.get(e,s.id);return(n==null?void 0:n.is_system)===!0}default:return!1}}catch{return!1}}function X(t){return{resource_server:"resource server",role:"role",connection:"connection"}[t]}function E(){return async(t,e)=>{if(!["PATCH","PUT","DELETE"].includes(t.req.method))return e();const s=Z(t.req.path);if(!s)return e();const n=t.var.tenant_id||t.req.header("x-tenant-id")||t.req.header("tenant-id");if(!n)return e();if(await J(t.env.data,n,s))throw new p(403,{message:`This ${X(s.type)} is a system resource and cannot be modified. Make changes in the main tenant instead.`});return e()}}function U(t){return async(e,s)=>{if(!t.accessControl)return s();const n=e.var.tenant_id,a=e.var.organization_id;if(!n)throw new p(400,{message:"Tenant ID not found in request"});if(!D(a,n,t.accessControl.mainTenantId))throw new p(403,{message:`Access denied to tenant ${n}`});return s()}}function N(t){return async(e,s)=>{if(!t.subdomainRouting)return s();const{baseDomain:n,reservedSubdomains:a=[],resolveSubdomain:c}=t.subdomainRouting,d=e.req.header("host")||"";let o=null;if(d.endsWith(n)){const r=d.slice(0,-(n.length+1));r&&!r.includes(".")&&(o=r)}if(o&&a.includes(o)&&(o=null),!o)return t.accessControl&&e.set("tenant_id",t.accessControl.mainTenantId),s();let i=null;if(c)i=await c(o);else if(t.subdomainRouting.useOrganizations!==!1&&t.accessControl)try{const r=await e.env.data.organizations.get(t.accessControl.mainTenantId,o);r&&(i=r.id)}catch{}if(!i)throw new p(404,{message:`Tenant not found for subdomain: ${o}`});return e.set("tenant_id",i),s()}}function K(t){return async(e,s)=>{if(!t.databaseIsolation)return s();const n=e.var.tenant_id;if(!n)throw new p(400,{message:"Tenant ID not found in request"});try{const a=await t.databaseIsolation.getAdapters(n);e.env.data=a}catch(a){throw console.error(`Failed to resolve database for tenant ${n}:`,a),new p(500,{message:"Failed to resolve tenant database"})}return s()}}function I(t){const e=N(t),s=U(t),n=K(t);return async(a,c)=>(await e(a,async()=>{}),await s(a,async()=>{}),await n(a,async()=>{}),c())}function k(t){const e=b(t);return{name:"multi-tenancy",middleware:I(t),hooks:e,routes:[{path:"/management",handler:S(t,e)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),t.accessControl&&console.log(`  - Access control enabled (main tenant: ${t.accessControl.mainTenantId})`),t.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`),t.databaseIsolation&&console.log("  - Database isolation enabled")}}}function b(t){const e=t.accessControl?q(t.accessControl):{},s=t.databaseIsolation?z(t.databaseIsolation):{},n=F(t);return{...e,...s,tenants:n}}function V(t){const e=new R.Hono,s=b(t);return e.route("/tenants",S(t,s)),e}function x(t){return{hooks:b(t),middleware:I(t),app:V(t),config:t}}function ee(t){const{mainTenantId:e="main",syncResourceServers:s=!0,multiTenancy:n,entityHooks:a,...c}=t,d={...n,accessControl:{mainTenantId:e,requireOrganizationMatch:!1,defaultPermissions:["tenant:admin"],...n==null?void 0:n.accessControl}},o=b(d);let i,r;s&&(i=j({mainTenantId:e,getChildTenantIds:async()=>(await P(y=>t.dataAdapter.tenants.list(y),"tenants",{cursorField:"id",pageSize:100})).filter(y=>y.id!==e).map(y=>y.id),getAdapters:async g=>t.dataAdapter}),r=O({mainTenantId:e,getMainTenantAdapters:async()=>t.dataAdapter,getAdapters:async g=>t.dataAdapter}));const l=async(g,y,...T)=>{const v=[];if(g)try{await g(...T)}catch(A){v.push(A instanceof Error?A:new Error(String(A)))}if(y)try{await y(...T)}catch(A){v.push(A instanceof Error?A:new Error(String(A)))}if(v.length===1)throw v[0];if(v.length>1)throw new AggregateError(v,`Multiple hook errors: ${v.map(A=>A.message).join("; ")}`)},f={...a,resourceServers:i?{...a==null?void 0:a.resourceServers,afterCreate:async(g,y)=>{var T;await l((T=a==null?void 0:a.resourceServers)==null?void 0:T.afterCreate,i==null?void 0:i.afterCreate,g,y)},afterUpdate:async(g,y,T)=>{var v;await l((v=a==null?void 0:a.resourceServers)==null?void 0:v.afterUpdate,i==null?void 0:i.afterUpdate,g,y,T)},afterDelete:async(g,y)=>{var T;await l((T=a==null?void 0:a.resourceServers)==null?void 0:T.afterDelete,i==null?void 0:i.afterDelete,g,y)}}:a==null?void 0:a.resourceServers,tenants:r?{...a==null?void 0:a.tenants,afterCreate:async(g,y)=>{var T;await l((T=a==null?void 0:a.tenants)==null?void 0:T.afterCreate,r==null?void 0:r.afterCreate,g,y)}}:a==null?void 0:a.tenants},u=C.init({...c,entityHooks:f}),{app:m,managementApp:h,..._}=u,w=new R.Hono;w.use("/api/v2/*",E()),w.route("/",m);const H=S(d,o);return w.route("/api/v2/tenants",H),{app:w,managementApp:h,..._,multiTenancyConfig:d,multiTenancyHooks:o}}Object.defineProperty(exports,"MANAGEMENT_API_SCOPES",{enumerable:!0,get:()=>C.MANAGEMENT_API_SCOPES});Object.defineProperty(exports,"seed",{enumerable:!0,get:()=>C.seed});exports.createAccessControlHooks=q;exports.createAccessControlMiddleware=U;exports.createDatabaseHooks=z;exports.createDatabaseMiddleware=K;exports.createMultiTenancy=V;exports.createMultiTenancyHooks=b;exports.createMultiTenancyMiddleware=I;exports.createMultiTenancyPlugin=k;exports.createProtectSyncedMiddleware=E;exports.createProvisioningHooks=F;exports.createResourceServerSyncHooks=j;exports.createSubdomainMiddleware=N;exports.createTenantResourceServerSyncHooks=O;exports.createTenantsRouter=S;exports.fetchAll=P;exports.init=ee;exports.setupMultiTenancy=x;exports.validateTenantAccess=D;
+"use strict";var W=Object.defineProperty;var G=(e,n,s)=>n in e?W(e,n,{enumerable:!0,configurable:!0,writable:!0,value:s}):e[n]=s;var z=(e,n,s)=>G(e,typeof n!="symbol"?n+"":n,s);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const I=require("hono"),S=require("authhero"),Q=require("zod"),$=require("@authhero/adapter-interfaces");function q(e){const{mainTenantId:n,requireOrganizationMatch:s=!0}=e;return{async onTenantAccessValidation(t,a){if(a===n)return!0;if(s){const o=t.var.organization_id;return o?o===a:!1}return!0}}}function P(e,n,s){return n===s?!0:e?e===n:!1}function D(e){return{async resolveDataAdapters(n){try{return await e.getAdapters(n)}catch(s){console.error(`Failed to resolve data adapters for tenant ${n}:`,s);return}}}}function F(e){return{async afterCreate(n,s){const{accessControl:t,databaseIsolation:a,settingsInheritance:o}=e;t&&n.ctx&&await V(n,s,t),a!=null&&a.onProvision&&await a.onProvision(s.id),(o==null?void 0:o.inheritFromMain)!==!1&&n.ctx&&await Y(n,s,e)},async beforeDelete(n,s){const{accessControl:t,databaseIsolation:a}=e;if(t)try{const d=(await n.adapters.organizations.list(t.mainTenantId)).organizations.find(i=>i.name===s);d&&await n.adapters.organizations.remove(t.mainTenantId,d.id)}catch(o){console.warn(`Failed to remove organization for tenant ${s}:`,o)}if(a!=null&&a.onDeprovision)try{await a.onDeprovision(s)}catch(o){console.warn(`Failed to deprovision database for tenant ${s}:`,o)}}}}async function V(e,n,s){const{mainTenantId:t,defaultPermissions:a,defaultRoles:o,issuer:d,adminRoleName:i="Tenant Admin",adminRoleDescription:c="Full access to all tenant management operations",addCreatorToOrganization:r=!0}=s;await e.adapters.organizations.create(t,{id:n.id,name:n.id,display_name:n.friendly_name||n.id});let l=null;if(d&&(l=await L(e,t,d,i,c)),r&&e.ctx){const f=e.ctx.var.user;if(f!=null&&f.sub)try{await e.adapters.userOrganizations.create(t,{user_id:f.sub,organization_id:n.id}),l&&await e.adapters.userRoles.create(t,f.sub,l,n.id)}catch(u){console.warn(`Failed to add creator ${f.sub} to organization ${n.id}:`,u)}}o&&o.length>0&&console.log(`Would assign roles ${o.join(", ")} to organization ${n.id}`),a&&a.length>0&&console.log(`Would grant permissions ${a.join(", ")} to organization ${n.id}`)}async function L(e,n,s,t,a){const d=(await e.adapters.roles.list(n,{})).roles.find(l=>l.name===t);if(d)return d.id;const i=await e.adapters.roles.create(n,{name:t,description:a}),c=`${s}api/v2/`,r=S.MANAGEMENT_API_SCOPES.map(l=>({role_id:i.id,resource_server_identifier:c,permission_name:l.value}));return await e.adapters.rolePermissions.assign(n,i.id,r),i.id}async function Y(e,n,s){const{accessControl:t,settingsInheritance:a}=s;if(!t)return;const o=await e.adapters.tenants.get(t.mainTenantId);if(!o)return;let d={...o};const i=["id","created_at","updated_at","friendly_name","audience","sender_email","sender_name"];for(const c of i)delete d[c];if(a!=null&&a.inheritedKeys){const c={};for(const r of a.inheritedKeys)r in o&&!i.includes(r)&&(c[r]=o[r]);d=c}if(a!=null&&a.excludedKeys)for(const c of a.excludedKeys)delete d[c];a!=null&&a.transformSettings&&(d=a.transformSettings(d,n.id)),Object.keys(d).length>0&&await e.adapters.tenants.update(n.id,d)}async function R(e,n,s={}){const{cursorField:t="id",sortOrder:a="asc",pageSize:o=100,maxItems:d=1e4,q:i}=s,c=[];let r,l=!0;for(;l;){let f=i||"";if(r){const w=`${t}:${a==="asc"?">":"<"}${r}`;f=f?`(${f}) AND ${w}`:w}const u={per_page:o,page:0,sort:{sort_by:t,sort_order:a},...f&&{q:f}},_=(await e(u))[n]||[];if(_.length===0)l=!1;else{c.push(..._);const g=_[_.length-1];if(g&&typeof g=="object"){const w=g[t];w!=null&&(r=String(w))}_.length<o&&(l=!1),d!==-1&&c.length>=d&&(console.warn(`fetchAll: Reached maxItems limit (${d}). There may be more items.`),l=!1)}}return c}function j(e){const{mainTenantId:n,getChildTenantIds:s,getAdapters:t,shouldSync:a=()=>!0,transformForSync:o}=e;async function d(r,l,f){return(await r.resourceServers.list(l,{q:`identifier:${f}`,per_page:1})).resource_servers[0]??null}async function i(r,l){const f=await s();await Promise.all(f.map(async u=>{try{const m=await t(u),g={...o?o(r,u):{name:r.name,identifier:r.identifier,scopes:r.scopes,signing_alg:r.signing_alg,signing_secret:r.signing_secret,token_lifetime:r.token_lifetime,token_lifetime_for_web:r.token_lifetime_for_web,skip_consent_for_verifiable_first_party_clients:r.skip_consent_for_verifiable_first_party_clients,allow_offline_access:r.allow_offline_access,verificationKey:r.verificationKey,options:r.options},is_system:!0};if(l==="create"){const w=await d(m,u,r.identifier);w&&w.id?await m.resourceServers.update(u,w.id,g):await m.resourceServers.create(u,g)}else{const w=await d(m,u,r.identifier);w&&w.id&&await m.resourceServers.update(u,w.id,g)}}catch(m){console.error(`Failed to sync resource server "${r.identifier}" to tenant "${u}":`,m)}}))}async function c(r){const l=await s();await Promise.all(l.map(async f=>{try{const u=await t(f),m=await d(u,f,r);m&&m.id&&await u.resourceServers.remove(f,m.id)}catch(u){console.error(`Failed to delete resource server "${r}" from tenant "${f}":`,u)}}))}return{afterCreate:async(r,l)=>{r.tenantId===n&&a(l)&&await i(l,"create")},afterUpdate:async(r,l,f)=>{r.tenantId===n&&a(f)&&await i(f,"update")},afterDelete:async(r,l)=>{r.tenantId===n&&await c(l)}}}function U(e){const{mainTenantId:n,getMainTenantAdapters:s,getAdapters:t,shouldSync:a=()=>!0,transformForSync:o}=e;return{async afterCreate(d,i){if(i.id!==n)try{const c=await s(),r=await t(i.id),l=await R(f=>c.resourceServers.list(n,f),"resource_servers",{cursorField:"id",pageSize:100});await Promise.all(l.filter(f=>a(f)).map(async f=>{const u=f;try{const m=o?o(u,i.id):{name:u.name,identifier:u.identifier,scopes:u.scopes,signing_alg:u.signing_alg,signing_secret:u.signing_secret,token_lifetime:u.token_lifetime,token_lifetime_for_web:u.token_lifetime_for_web,skip_consent_for_verifiable_first_party_clients:u.skip_consent_for_verifiable_first_party_clients,allow_offline_access:u.allow_offline_access,verificationKey:u.verificationKey,options:u.options};await r.resourceServers.create(i.id,{...m,is_system:!0})}catch(m){console.error(`Failed to sync resource server "${u.identifier}" to new tenant "${i.id}":`,m)}}))}catch(c){console.error(`Failed to sync resource servers to new tenant "${i.id}":`,c)}}}}var p=class extends Error{constructor(n=500,s){super(s==null?void 0:s.message,{cause:s==null?void 0:s.cause});z(this,"res");z(this,"status");this.res=s==null?void 0:s.res,this.status=n}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function M(e,n){const s=new I.Hono;return s.get("/",async t=>{var f,u;const a=$.auth0QuerySchema.parse(t.req.query()),{page:o,per_page:d,include_totals:i,q:c}=a,r=t.var.user;if(e.accessControl&&(r!=null&&r.sub)){const m=e.accessControl.mainTenantId,g=(await t.env.data.userOrganizations.listUserOrganizations(m,r.sub,{})).organizations.map(y=>y.id);g.includes(m)||g.push(m);const w=await t.env.data.tenants.list({page:o,per_page:d,include_totals:i,q:c}),A=w.tenants.filter(y=>g.includes(y.id));return i?t.json({tenants:A,start:((f=w.totals)==null?void 0:f.start)??0,limit:((u=w.totals)==null?void 0:u.limit)??d,length:A.length}):t.json(A)}const l=await t.env.data.tenants.list({page:o,per_page:d,include_totals:i,q:c});return i?t.json(l):t.json(l.tenants)}),s.get("/:id",async t=>{const a=t.req.param("id");if(e.accessControl){const d=t.var.user,i=e.accessControl.mainTenantId;if(a!==i){if(!(d!=null&&d.sub))throw new p(401,{message:"Authentication required"});if(!(await t.env.data.userOrganizations.listUserOrganizations(i,d.sub,{})).organizations.some(l=>l.id===a))throw new p(403,{message:"Access denied to this tenant"})}}const o=await t.env.data.tenants.get(a);if(!o)throw new p(404,{message:"Tenant not found"});return t.json(o)}),s.post("/",async t=>{var a,o,d;try{const i=t.var.user;if(!(i!=null&&i.sub))throw new p(401,{message:"Authentication required to create tenants"});let c=$.tenantInsertSchema.parse(await t.req.json());const r={adapters:t.env.data,ctx:t};(a=n.tenants)!=null&&a.beforeCreate&&(c=await n.tenants.beforeCreate(r,c));const l=await t.env.data.tenants.create(c);return(o=n.tenants)!=null&&o.afterCreate&&await n.tenants.afterCreate(r,l),t.json(l,201)}catch(i){throw i instanceof Q.z.ZodError?new p(400,{message:"Validation error",cause:i}):i instanceof Error&&("code"in i&&i.code==="SQLITE_CONSTRAINT_PRIMARYKEY"||(d=i.message)!=null&&d.includes("UNIQUE constraint failed"))?new p(409,{message:"Tenant with this ID already exists"}):i}}),s.patch("/:id",async t=>{var u,m;const a=t.req.param("id");if(e.accessControl){const _=t.var.user;if(!(_!=null&&_.sub))throw new p(401,{message:"Authentication required to update tenants"});const g=e.accessControl.mainTenantId;if(a!==g&&!(await t.env.data.userOrganizations.listUserOrganizations(g,_.sub,{})).organizations.some(y=>y.id===a))throw new p(403,{message:"Access denied to update this tenant"})}const o=$.tenantInsertSchema.partial().parse(await t.req.json()),{id:d,...i}=o;if(!await t.env.data.tenants.get(a))throw new p(404,{message:"Tenant not found"});const r={adapters:t.env.data,ctx:t};let l=i;(u=n.tenants)!=null&&u.beforeUpdate&&(l=await n.tenants.beforeUpdate(r,a,i)),await t.env.data.tenants.update(a,l);const f=await t.env.data.tenants.get(a);if(!f)throw new p(404,{message:"Tenant not found after update"});return(m=n.tenants)!=null&&m.afterUpdate&&await n.tenants.afterUpdate(r,f),t.json(f)}),s.delete("/:id",async t=>{var i,c;const a=t.req.param("id");if(e.accessControl&&a===e.accessControl.mainTenantId)throw new p(400,{message:"Cannot delete the main tenant"});if(e.accessControl){const r=t.var.user;if(!(r!=null&&r.sub))throw new p(401,{message:"Authentication required to delete tenants"});const l=e.accessControl.mainTenantId;if(!(await t.env.data.userOrganizations.listUserOrganizations(l,r.sub,{})).organizations.some(m=>m.id===a))throw new p(403,{message:"Access denied to delete this tenant"})}if(!await t.env.data.tenants.get(a))throw new p(404,{message:"Tenant not found"});const d={adapters:t.env.data,ctx:t};return(i=n.tenants)!=null&&i.beforeDelete&&await n.tenants.beforeDelete(d,a),await t.env.data.tenants.remove(a),(c=n.tenants)!=null&&c.afterDelete&&await n.tenants.afterDelete(d,a),t.body(null,204)}),s}function B(e){const n=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:s,type:t}of n){const a=e.match(s);if(a&&a[1])return{type:t,id:a[1]}}return null}async function Z(e,n,s){try{switch(s.type){case"resource_server":{const t=await e.resourceServers.get(n,s.id);return(t==null?void 0:t.is_system)===!0}case"role":{const t=await e.roles.get(n,s.id);return(t==null?void 0:t.is_system)===!0}case"connection":{const t=await e.connections.get(n,s.id);return(t==null?void 0:t.is_system)===!0}default:return!1}}catch{return!1}}function J(e){return{resource_server:"resource server",role:"role",connection:"connection"}[e]}function E(){return async(e,n)=>{if(!["PATCH","PUT","DELETE"].includes(e.req.method))return n();const s=B(e.req.path);if(!s)return n();const t=e.var.tenant_id||e.req.header("x-tenant-id")||e.req.header("tenant-id");if(!t)return n();if(await Z(e.env.data,t,s))throw new p(403,{message:`This ${J(s.type)} is a system resource and cannot be modified. Make changes in the main tenant instead.`});return n()}}function N(e){return async(n,s)=>{if(!e.accessControl)return s();const t=n.var.tenant_id,a=n.var.organization_id;if(!t)throw new p(400,{message:"Tenant ID not found in request"});if(!P(a,t,e.accessControl.mainTenantId))throw new p(403,{message:`Access denied to tenant ${t}`});return s()}}function k(e){return async(n,s)=>{if(!e.subdomainRouting)return s();const{baseDomain:t,reservedSubdomains:a=[],resolveSubdomain:o}=e.subdomainRouting,d=n.req.header("host")||"";let i=null;if(d.endsWith(t)){const r=d.slice(0,-(t.length+1));r&&!r.includes(".")&&(i=r)}if(i&&a.includes(i)&&(i=null),!i)return e.accessControl&&n.set("tenant_id",e.accessControl.mainTenantId),s();let c=null;if(o)c=await o(i);else if(e.subdomainRouting.useOrganizations!==!1&&e.accessControl)try{const r=await n.env.data.organizations.get(e.accessControl.mainTenantId,i);r&&(c=r.id)}catch{}if(!c)throw new p(404,{message:`Tenant not found for subdomain: ${i}`});return n.set("tenant_id",c),s()}}function K(e){return async(n,s)=>{if(!e.databaseIsolation)return s();const t=n.var.tenant_id;if(!t)throw new p(400,{message:"Tenant ID not found in request"});try{const a=await e.databaseIsolation.getAdapters(t);n.env.data=a}catch(a){throw console.error(`Failed to resolve database for tenant ${t}:`,a),new p(500,{message:"Failed to resolve tenant database"})}return s()}}function O(e){const n=k(e),s=N(e),t=K(e);return async(a,o)=>(await n(a,async()=>{}),await s(a,async()=>{}),await t(a,async()=>{}),o())}function X(e){const n=C(e);return{name:"multi-tenancy",middleware:O(e),hooks:n,routes:[{path:"/management",handler:M(e,n)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),e.accessControl&&console.log(`  - Access control enabled (main tenant: ${e.accessControl.mainTenantId})`),e.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`),e.databaseIsolation&&console.log("  - Database isolation enabled")}}}function C(e){const n=e.accessControl?q(e.accessControl):{},s=e.databaseIsolation?D(e.databaseIsolation):{},t=F(e);return{...n,...s,tenants:t}}function H(e){const n=new I.Hono,s=C(e);return n.route("/tenants",M(e,s)),n}function x(e){return{hooks:C(e),middleware:O(e),app:H(e),config:e}}function ee(e){const{mainTenantId:n="main",syncResourceServers:s=!0,multiTenancy:t,entityHooks:a,...o}=e,d={...t,accessControl:{mainTenantId:n,requireOrganizationMatch:!1,defaultPermissions:["tenant:admin"],...t==null?void 0:t.accessControl}},i=C(d);let c,r;s&&(c=j({mainTenantId:n,getChildTenantIds:async()=>(await R(h=>e.dataAdapter.tenants.list(h),"tenants",{cursorField:"id",pageSize:100})).filter(h=>h.id!==n).map(h=>h.id),getAdapters:async y=>e.dataAdapter}),r=U({mainTenantId:n,getMainTenantAdapters:async()=>e.dataAdapter,getAdapters:async y=>e.dataAdapter}));const l=async(y,h,...T)=>{const v=[];if(y)try{await y(...T)}catch(b){v.push(b instanceof Error?b:new Error(String(b)))}if(h)try{await h(...T)}catch(b){v.push(b instanceof Error?b:new Error(String(b)))}if(v.length===1)throw v[0];if(v.length>1)throw new AggregateError(v,`Multiple hook errors: ${v.map(b=>b.message).join("; ")}`)},f={...a,resourceServers:c?{...a==null?void 0:a.resourceServers,afterCreate:async(y,h)=>{var T;await l((T=a==null?void 0:a.resourceServers)==null?void 0:T.afterCreate,c==null?void 0:c.afterCreate,y,h)},afterUpdate:async(y,h,T)=>{var v;await l((v=a==null?void 0:a.resourceServers)==null?void 0:v.afterUpdate,c==null?void 0:c.afterUpdate,y,h,T)},afterDelete:async(y,h)=>{var T;await l((T=a==null?void 0:a.resourceServers)==null?void 0:T.afterDelete,c==null?void 0:c.afterDelete,y,h)}}:a==null?void 0:a.resourceServers,tenants:r?{...a==null?void 0:a.tenants,afterCreate:async(y,h)=>{var T;await l((T=a==null?void 0:a.tenants)==null?void 0:T.afterCreate,r==null?void 0:r.afterCreate,y,h)}}:a==null?void 0:a.tenants},u=S.init({...o,entityHooks:f}),{app:m,managementApp:_,...g}=u,w=new I.Hono;w.use("/api/v2/*",E()),w.route("/",m);const A=M(d,i);return w.route("/api/v2/tenants",A),{app:w,managementApp:_,...g,multiTenancyConfig:d,multiTenancyHooks:i}}Object.defineProperty(exports,"MANAGEMENT_API_SCOPES",{enumerable:!0,get:()=>S.MANAGEMENT_API_SCOPES});Object.defineProperty(exports,"seed",{enumerable:!0,get:()=>S.seed});exports.createAccessControlHooks=q;exports.createAccessControlMiddleware=N;exports.createDatabaseHooks=D;exports.createDatabaseMiddleware=K;exports.createMultiTenancy=H;exports.createMultiTenancyHooks=C;exports.createMultiTenancyMiddleware=O;exports.createMultiTenancyPlugin=X;exports.createProtectSyncedMiddleware=E;exports.createProvisioningHooks=F;exports.createResourceServerSyncHooks=j;exports.createSubdomainMiddleware=k;exports.createTenantResourceServerSyncHooks=U;exports.createTenantsRouter=M;exports.fetchAll=R;exports.init=ee;exports.setupMultiTenancy=x;exports.validateTenantAccess=P;

package/dist/multi-tenancy.d.ts

@@ -9713,6 +9713,7 @@ export interface SeedResult {
 	userId: string;
 	email: string;
 	clientId: string;
+	clientSecret: string;
 }
 /**
  * Seed the AuthHero database with initial data.

package/dist/multi-tenancy.mjs

@@ -1,36 +1,36 @@
-var D = Object.defineProperty;
-var q = (t, e, s) => e in t ? D(t, e, { enumerable: !0, configurable: !0, writable: !0, value: s }) : t[e] = s;
-var C = (t, e, s) => q(t, typeof e != "symbol" ? e + "" : e, s);
+var O = Object.defineProperty;
+var q = (e, n, s) => n in e ? O(e, n, { enumerable: !0, configurable: !0, writable: !0, value: s }) : e[n] = s;
+var z = (e, n, s) => q(e, typeof n != "symbol" ? n + "" : n, s);
 import { Hono as $ } from "hono";
-import { MANAGEMENT_API_SCOPES as F, init as P } from "authhero";
+import { MANAGEMENT_API_SCOPES as D, init as F } from "authhero";
 import { MANAGEMENT_API_SCOPES as le, seed as ue } from "authhero";
-import { z as j } from "zod";
-import { auth0QuerySchema as U, tenantInsertSchema as R } from "@authhero/adapter-interfaces";
-function O(t) {
-  const { mainTenantId: e, requireOrganizationMatch: s = !0 } = t;
+import { z as P } from "zod";
+import { auth0QuerySchema as U, tenantInsertSchema as I } from "@authhero/adapter-interfaces";
+function j(e) {
+  const { mainTenantId: n, requireOrganizationMatch: s = !0 } = e;
   return {
-    async onTenantAccessValidation(n, a) {
-      if (a === e)
+    async onTenantAccessValidation(t, a) {
+      if (a === n)
         return !0;
       if (s) {
-        const c = n.var.organization_id;
-        return c ? c === a : !1;
+        const o = t.var.organization_id;
+        return o ? o === a : !1;
       }
       return !0;
     }
   };
 }
-function E(t, e, s) {
-  return e === s ? !0 : t ? t === e : !1;
+function E(e, n, s) {
+  return n === s ? !0 : e ? e === n : !1;
 }
-function K(t) {
+function K(e) {
   return {
-    async resolveDataAdapters(e) {
+    async resolveDataAdapters(n) {
       try {
-        return await t.getAdapters(e);
+        return await e.getAdapters(n);
       } catch (s) {
         console.error(
-          `Failed to resolve data adapters for tenant ${e}:`,
+          `Failed to resolve data adapters for tenant ${n}:`,
           s
         );
         return;
@@ -38,113 +38,113 @@ function K(t) {
     }
   };
 }
-function N(t) {
+function N(e) {
   return {
-    async afterCreate(e, s) {
-      const { accessControl: n, databaseIsolation: a, settingsInheritance: c } = t;
-      n && e.ctx && await V(e, s, n), a != null && a.onProvision && await a.onProvision(s.id), (c == null ? void 0 : c.inheritFromMain) !== !1 && e.ctx && await Q(e, s, t);
+    async afterCreate(n, s) {
+      const { accessControl: t, databaseIsolation: a, settingsInheritance: o } = e;
+      t && n.ctx && await W(n, s, t), a != null && a.onProvision && await a.onProvision(s.id), (o == null ? void 0 : o.inheritFromMain) !== !1 && n.ctx && await Q(n, s, e);
     },
-    async beforeDelete(e, s) {
-      const { accessControl: n, databaseIsolation: a } = t;
-      if (n)
+    async beforeDelete(n, s) {
+      const { accessControl: t, databaseIsolation: a } = e;
+      if (t)
         try {
-          const d = (await e.adapters.organizations.list(
-            n.mainTenantId
-          )).organizations.find((o) => o.name === s);
-          d && await e.adapters.organizations.remove(
-            n.mainTenantId,
+          const d = (await n.adapters.organizations.list(
+            t.mainTenantId
+          )).organizations.find((i) => i.name === s);
+          d && await n.adapters.organizations.remove(
+            t.mainTenantId,
             d.id
           );
-        } catch (c) {
+        } catch (o) {
           console.warn(
             `Failed to remove organization for tenant ${s}:`,
-            c
+            o
           );
         }
       if (a != null && a.onDeprovision)
         try {
           await a.onDeprovision(s);
-        } catch (c) {
+        } catch (o) {
           console.warn(
             `Failed to deprovision database for tenant ${s}:`,
-            c
+            o
           );
         }
     }
   };
 }
-async function V(t, e, s) {
+async function W(e, n, s) {
   const {
-    mainTenantId: n,
+    mainTenantId: t,
     defaultPermissions: a,
-    defaultRoles: c,
+    defaultRoles: o,
     issuer: d,
-    adminRoleName: o = "Tenant Admin",
-    adminRoleDescription: i = "Full access to all tenant management operations",
+    adminRoleName: i = "Tenant Admin",
+    adminRoleDescription: c = "Full access to all tenant management operations",
     addCreatorToOrganization: r = !0
   } = s;
-  await t.adapters.organizations.create(n, {
-    id: e.id,
-    name: e.id,
-    display_name: e.friendly_name || e.id
+  await e.adapters.organizations.create(t, {
+    id: n.id,
+    name: n.id,
+    display_name: n.friendly_name || n.id
   });
   let l = null;
-  if (d && (l = await W(
+  if (d && (l = await k(
+    e,
     t,
-    n,
     d,
-    o,
-    i
-  )), r && t.ctx) {
-    const f = t.ctx.var.user;
+    i,
+    c
+  )), r && e.ctx) {
+    const f = e.ctx.var.user;
     if (f != null && f.sub)
       try {
-        await t.adapters.userOrganizations.create(n, {
+        await e.adapters.userOrganizations.create(t, {
           user_id: f.sub,
-          organization_id: e.id
-        }), l && await t.adapters.userRoles.create(
-          n,
+          organization_id: n.id
+        }), l && await e.adapters.userRoles.create(
+          t,
           f.sub,
           l,
-          e.id
+          n.id
           // organizationId
         );
       } catch (u) {
         console.warn(
-          `Failed to add creator ${f.sub} to organization ${e.id}:`,
+          `Failed to add creator ${f.sub} to organization ${n.id}:`,
           u
         );
       }
   }
-  c && c.length > 0 && console.log(
-    `Would assign roles ${c.join(", ")} to organization ${e.id}`
+  o && o.length > 0 && console.log(
+    `Would assign roles ${o.join(", ")} to organization ${n.id}`
   ), a && a.length > 0 && console.log(
-    `Would grant permissions ${a.join(", ")} to organization ${e.id}`
+    `Would grant permissions ${a.join(", ")} to organization ${n.id}`
   );
 }
-async function W(t, e, s, n, a) {
-  const d = (await t.adapters.roles.list(e, {})).roles.find((l) => l.name === n);
+async function k(e, n, s, t, a) {
+  const d = (await e.adapters.roles.list(n, {})).roles.find((l) => l.name === t);
   if (d)
     return d.id;
-  const o = await t.adapters.roles.create(e, {
-    name: n,
+  const i = await e.adapters.roles.create(n, {
+    name: t,
     description: a
-  }), i = `${s}api/v2/`, r = F.map((l) => ({
-    role_id: o.id,
-    resource_server_identifier: i,
+  }), c = `${s}api/v2/`, r = D.map((l) => ({
+    role_id: i.id,
+    resource_server_identifier: c,
     permission_name: l.value
   }));
-  return await t.adapters.rolePermissions.assign(e, o.id, r), o.id;
+  return await e.adapters.rolePermissions.assign(n, i.id, r), i.id;
 }
-async function Q(t, e, s) {
-  const { accessControl: n, settingsInheritance: a } = s;
-  if (!n)
+async function Q(e, n, s) {
+  const { accessControl: t, settingsInheritance: a } = s;
+  if (!t)
     return;
-  const c = await t.adapters.tenants.get(n.mainTenantId);
-  if (!c)
+  const o = await e.adapters.tenants.get(t.mainTenantId);
+  if (!o)
     return;
-  let d = { ...c };
-  const o = [
+  let d = { ...o };
+  const i = [
     "id",
     "created_at",
     "updated_at",
@@ -154,83 +154,83 @@ async function Q(t, e, s) {
     "sender_email",
     "sender_name"
   ];
-  for (const i of o)
-    delete d[i];
+  for (const c of i)
+    delete d[c];
   if (a != null && a.inheritedKeys) {
-    const i = {};
+    const c = {};
     for (const r of a.inheritedKeys)
-      r in c && !o.includes(r) && (i[r] = c[r]);
-    d = i;
+      r in o && !i.includes(r) && (c[r] = o[r]);
+    d = c;
   }
   if (a != null && a.excludedKeys)
-    for (const i of a.excludedKeys)
-      delete d[i];
+    for (const c of a.excludedKeys)
+      delete d[c];
   a != null && a.transformSettings && (d = a.transformSettings(
     d,
-    e.id
-  )), Object.keys(d).length > 0 && await t.adapters.tenants.update(e.id, d);
+    n.id
+  )), Object.keys(d).length > 0 && await e.adapters.tenants.update(n.id, d);
 }
-async function M(t, e, s = {}) {
+async function R(e, n, s = {}) {
   const {
-    cursorField: n = "id",
+    cursorField: t = "id",
     sortOrder: a = "asc",
-    pageSize: c = 100,
+    pageSize: o = 100,
     maxItems: d = 1e4,
-    q: o
-  } = s, i = [];
+    q: i
+  } = s, c = [];
   let r, l = !0;
   for (; l; ) {
-    let f = o || "";
+    let f = i || "";
     if (r) {
-      const w = `${n}:${a === "asc" ? ">" : "<"}${r}`;
+      const w = `${t}:${a === "asc" ? ">" : "<"}${r}`;
       f = f ? `(${f}) AND ${w}` : w;
     }
     const u = {
-      per_page: c,
+      per_page: o,
       page: 0,
       // Always use page 0 since we're doing cursor-based pagination
       sort: {
-        sort_by: n,
+        sort_by: t,
         sort_order: a
       },
       ...f && { q: f }
-    }, T = (await t(u))[e] || [];
-    if (T.length === 0)
+    }, _ = (await e(u))[n] || [];
+    if (_.length === 0)
       l = !1;
     else {
-      i.push(...T);
-      const _ = T[T.length - 1];
-      if (_ && typeof _ == "object") {
-        const w = _[n];
+      c.push(..._);
+      const g = _[_.length - 1];
+      if (g && typeof g == "object") {
+        const w = g[t];
         w != null && (r = String(w));
       }
-      T.length < c && (l = !1), d !== -1 && i.length >= d && (console.warn(
+      _.length < o && (l = !1), d !== -1 && c.length >= d && (console.warn(
         `fetchAll: Reached maxItems limit (${d}). There may be more items.`
       ), l = !1);
     }
   }
-  return i;
+  return c;
 }
-function G(t) {
+function V(e) {
   const {
-    mainTenantId: e,
+    mainTenantId: n,
     getChildTenantIds: s,
-    getAdapters: n,
+    getAdapters: t,
     shouldSync: a = () => !0,
-    transformForSync: c
-  } = t;
+    transformForSync: o
+  } = e;
   async function d(r, l, f) {
     return (await r.resourceServers.list(l, {
       q: `identifier:${f}`,
       per_page: 1
     })).resource_servers[0] ?? null;
   }
-  async function o(r, l) {
+  async function i(r, l) {
     const f = await s();
     await Promise.all(
       f.map(async (u) => {
         try {
-          const m = await n(u), _ = { ...c ? c(r, u) : {
+          const m = await t(u), g = { ...o ? o(r, u) : {
             name: r.name,
             identifier: r.identifier,
             scopes: r.scopes,
@@ -252,8 +252,8 @@ function G(t) {
             w && w.id ? await m.resourceServers.update(
               u,
               w.id,
-              _
-            ) : await m.resourceServers.create(u, _);
+              g
+            ) : await m.resourceServers.create(u, g);
           } else {
             const w = await d(
               m,
@@ -263,7 +263,7 @@ function G(t) {
             w && w.id && await m.resourceServers.update(
               u,
               w.id,
-              _
+              g
             );
           }
         } catch (m) {
@@ -275,12 +275,12 @@ function G(t) {
       })
     );
   }
-  async function i(r) {
+  async function c(r) {
     const l = await s();
     await Promise.all(
       l.map(async (f) => {
         try {
-          const u = await n(f), m = await d(
+          const u = await t(f), m = await d(
             u,
             f,
             r
@@ -297,30 +297,30 @@ function G(t) {
   }
   return {
     afterCreate: async (r, l) => {
-      r.tenantId === e && a(l) && await o(l, "create");
+      r.tenantId === n && a(l) && await i(l, "create");
     },
     afterUpdate: async (r, l, f) => {
-      r.tenantId === e && a(f) && await o(f, "update");
+      r.tenantId === n && a(f) && await i(f, "update");
     },
     afterDelete: async (r, l) => {
-      r.tenantId === e && await i(l);
+      r.tenantId === n && await c(l);
     }
   };
 }
-function L(t) {
+function G(e) {
   const {
-    mainTenantId: e,
+    mainTenantId: n,
     getMainTenantAdapters: s,
-    getAdapters: n,
+    getAdapters: t,
     shouldSync: a = () => !0,
-    transformForSync: c
-  } = t;
+    transformForSync: o
+  } = e;
   return {
-    async afterCreate(d, o) {
-      if (o.id !== e)
+    async afterCreate(d, i) {
+      if (i.id !== n)
         try {
-          const i = await s(), r = await n(o.id), l = await M(
-            (f) => i.resourceServers.list(e, f),
+          const c = await s(), r = await t(i.id), l = await R(
+            (f) => c.resourceServers.list(n, f),
             "resource_servers",
             { cursorField: "id", pageSize: 100 }
           );
@@ -328,7 +328,7 @@ function L(t) {
             l.filter((f) => a(f)).map(async (f) => {
               const u = f;
               try {
-                const m = c ? c(u, o.id) : {
+                const m = o ? o(u, i.id) : {
                   name: u.name,
                   identifier: u.identifier,
                   scopes: u.scopes,
@@ -341,22 +341,22 @@ function L(t) {
                   verificationKey: u.verificationKey,
                   options: u.options
                 };
-                await r.resourceServers.create(o.id, {
+                await r.resourceServers.create(i.id, {
                   ...m,
                   is_system: !0
                 });
               } catch (m) {
                 console.error(
-                  `Failed to sync resource server "${u.identifier}" to new tenant "${o.id}":`,
+                  `Failed to sync resource server "${u.identifier}" to new tenant "${i.id}":`,
                   m
                 );
               }
             })
           );
-        } catch (i) {
+        } catch (c) {
           console.error(
-            `Failed to sync resource servers to new tenant "${o.id}":`,
-            i
+            `Failed to sync resource servers to new tenant "${i.id}":`,
+            c
           );
         }
     }
@@ -368,11 +368,11 @@ var p = class extends Error {
    * @param status - HTTP status code for the exception. Defaults to 500.
    * @param options - Additional options for the exception.
    */
-  constructor(e = 500, s) {
+  constructor(n = 500, s) {
     super(s == null ? void 0 : s.message, { cause: s == null ? void 0 : s.cause });
-    C(this, "res");
-    C(this, "status");
-    this.res = s == null ? void 0 : s.res, this.status = e;
+    z(this, "res");
+    z(this, "status");
+    this.res = s == null ? void 0 : s.res, this.status = n;
   }
   /**
    * Returns the response object associated with the exception.
@@ -388,119 +388,163 @@ var p = class extends Error {
     });
   }
 };
-function S(t, e) {
+function S(e, n) {
   const s = new $();
-  return s.get("/", async (n) => {
-    var l;
-    if (t.accessControl && await ((l = e.onTenantAccessValidation) == null ? void 0 : l.call(
-      e,
-      n,
-      t.accessControl.mainTenantId
-    )) === !1)
-      throw new p(403, {
-        message: "Access denied to tenant management"
-      });
-    const a = U.parse(n.req.query()), { page: c, per_page: d, include_totals: o, q: i } = a, r = await n.env.data.tenants.list({
-      page: c,
+  return s.get("/", async (t) => {
+    var f, u;
+    const a = U.parse(t.req.query()), { page: o, per_page: d, include_totals: i, q: c } = a, r = t.var.user;
+    if (e.accessControl && (r != null && r.sub)) {
+      const m = e.accessControl.mainTenantId, g = (await t.env.data.userOrganizations.listUserOrganizations(
+        m,
+        r.sub,
+        {}
+      )).organizations.map((y) => y.id);
+      g.includes(m) || g.push(m);
+      const w = await t.env.data.tenants.list({
+        page: o,
+        per_page: d,
+        include_totals: i,
+        q: c
+      }), C = w.tenants.filter(
+        (y) => g.includes(y.id)
+      );
+      return i ? t.json({
+        tenants: C,
+        start: ((f = w.totals) == null ? void 0 : f.start) ?? 0,
+        limit: ((u = w.totals) == null ? void 0 : u.limit) ?? d,
+        length: C.length
+      }) : t.json(C);
+    }
+    const l = await t.env.data.tenants.list({
+      page: o,
       per_page: d,
-      include_totals: o,
-      q: i
+      include_totals: i,
+      q: c
     });
-    return o ? n.json(r) : n.json(r.tenants);
-  }), s.get("/:id", async (n) => {
-    var o;
-    const a = n.req.param("id");
-    if (await ((o = e.onTenantAccessValidation) == null ? void 0 : o.call(e, n, a)) === !1)
-      throw new p(403, {
-        message: "Access denied to this tenant"
-      });
-    const d = await n.env.data.tenants.get(a);
-    if (!d)
+    return i ? t.json(l) : t.json(l.tenants);
+  }), s.get("/:id", async (t) => {
+    const a = t.req.param("id");
+    if (e.accessControl) {
+      const d = t.var.user, i = e.accessControl.mainTenantId;
+      if (a !== i) {
+        if (!(d != null && d.sub))
+          throw new p(401, {
+            message: "Authentication required"
+          });
+        if (!(await t.env.data.userOrganizations.listUserOrganizations(
+          i,
+          d.sub,
+          {}
+        )).organizations.some((l) => l.id === a))
+          throw new p(403, {
+            message: "Access denied to this tenant"
+          });
+      }
+    }
+    const o = await t.env.data.tenants.get(a);
+    if (!o)
       throw new p(404, {
         message: "Tenant not found"
       });
-    return n.json(d);
-  }), s.post("/", async (n) => {
-    var a, c, d, o;
+    return t.json(o);
+  }), s.post("/", async (t) => {
+    var a, o, d;
     try {
-      if (t.accessControl && await ((a = e.onTenantAccessValidation) == null ? void 0 : a.call(
-        e,
-        n,
-        t.accessControl.mainTenantId
-      )) === !1)
-        throw new p(403, {
-          message: "Access denied to create tenants"
+      const i = t.var.user;
+      if (!(i != null && i.sub))
+        throw new p(401, {
+          message: "Authentication required to create tenants"
         });
-      let i = R.parse(
-        await n.req.json()
+      let c = I.parse(
+        await t.req.json()
       );
       const r = {
-        adapters: n.env.data,
-        ctx: n
+        adapters: t.env.data,
+        ctx: t
       };
-      (c = e.tenants) != null && c.beforeCreate && (i = await e.tenants.beforeCreate(r, i));
-      const l = await n.env.data.tenants.create(i);
-      return (d = e.tenants) != null && d.afterCreate && await e.tenants.afterCreate(r, l), n.json(l, 201);
+      (a = n.tenants) != null && a.beforeCreate && (c = await n.tenants.beforeCreate(r, c));
+      const l = await t.env.data.tenants.create(c);
+      return (o = n.tenants) != null && o.afterCreate && await n.tenants.afterCreate(r, l), t.json(l, 201);
     } catch (i) {
-      throw i instanceof j.ZodError ? new p(400, {
+      throw i instanceof P.ZodError ? new p(400, {
         message: "Validation error",
         cause: i
-      }) : i instanceof Error && ("code" in i && i.code === "SQLITE_CONSTRAINT_PRIMARYKEY" || (o = i.message) != null && o.includes("UNIQUE constraint failed")) ? new p(409, {
+      }) : i instanceof Error && ("code" in i && i.code === "SQLITE_CONSTRAINT_PRIMARYKEY" || (d = i.message) != null && d.includes("UNIQUE constraint failed")) ? new p(409, {
         message: "Tenant with this ID already exists"
       }) : i;
     }
-  }), s.patch("/:id", async (n) => {
-    var m, T, _;
-    const a = n.req.param("id");
-    if (await ((m = e.onTenantAccessValidation) == null ? void 0 : m.call(e, n, a)) === !1)
-      throw new p(403, {
-        message: "Access denied to update this tenant"
-      });
-    const d = R.partial().parse(await n.req.json()), { id: o, ...i } = d;
-    if (!await n.env.data.tenants.get(a))
+  }), s.patch("/:id", async (t) => {
+    var u, m;
+    const a = t.req.param("id");
+    if (e.accessControl) {
+      const _ = t.var.user;
+      if (!(_ != null && _.sub))
+        throw new p(401, {
+          message: "Authentication required to update tenants"
+        });
+      const g = e.accessControl.mainTenantId;
+      if (a !== g && !(await t.env.data.userOrganizations.listUserOrganizations(
+        g,
+        _.sub,
+        {}
+      )).organizations.some((y) => y.id === a))
+        throw new p(403, {
+          message: "Access denied to update this tenant"
+        });
+    }
+    const o = I.partial().parse(await t.req.json()), { id: d, ...i } = o;
+    if (!await t.env.data.tenants.get(a))
       throw new p(404, {
         message: "Tenant not found"
       });
-    const l = {
-      adapters: n.env.data,
-      ctx: n
+    const r = {
+      adapters: t.env.data,
+      ctx: t
     };
-    let f = i;
-    (T = e.tenants) != null && T.beforeUpdate && (f = await e.tenants.beforeUpdate(l, a, i)), await n.env.data.tenants.update(a, f);
-    const u = await n.env.data.tenants.get(a);
-    if (!u)
+    let l = i;
+    (u = n.tenants) != null && u.beforeUpdate && (l = await n.tenants.beforeUpdate(r, a, i)), await t.env.data.tenants.update(a, l);
+    const f = await t.env.data.tenants.get(a);
+    if (!f)
       throw new p(404, {
         message: "Tenant not found after update"
       });
-    return (_ = e.tenants) != null && _.afterUpdate && await e.tenants.afterUpdate(l, u), n.json(u);
-  }), s.delete("/:id", async (n) => {
-    var o, i, r;
-    const a = n.req.param("id");
-    if (t.accessControl && a === t.accessControl.mainTenantId)
+    return (m = n.tenants) != null && m.afterUpdate && await n.tenants.afterUpdate(r, f), t.json(f);
+  }), s.delete("/:id", async (t) => {
+    var i, c;
+    const a = t.req.param("id");
+    if (e.accessControl && a === e.accessControl.mainTenantId)
       throw new p(400, {
         message: "Cannot delete the main tenant"
       });
-    if (t.accessControl && await ((o = e.onTenantAccessValidation) == null ? void 0 : o.call(
-      e,
-      n,
-      t.accessControl.mainTenantId
-    )) === !1)
-      throw new p(403, {
-        message: "Access denied to delete tenants"
-      });
-    if (!await n.env.data.tenants.get(a))
+    if (e.accessControl) {
+      const r = t.var.user;
+      if (!(r != null && r.sub))
+        throw new p(401, {
+          message: "Authentication required to delete tenants"
+        });
+      const l = e.accessControl.mainTenantId;
+      if (!(await t.env.data.userOrganizations.listUserOrganizations(
+        l,
+        r.sub,
+        {}
+      )).organizations.some((m) => m.id === a))
+        throw new p(403, {
+          message: "Access denied to delete this tenant"
+        });
+    }
+    if (!await t.env.data.tenants.get(a))
       throw new p(404, {
         message: "Tenant not found"
       });
     const d = {
-      adapters: n.env.data,
-      ctx: n
+      adapters: t.env.data,
+      ctx: t
     };
-    return (i = e.tenants) != null && i.beforeDelete && await e.tenants.beforeDelete(d, a), await n.env.data.tenants.remove(a), (r = e.tenants) != null && r.afterDelete && await e.tenants.afterDelete(d, a), n.body(null, 204);
+    return (i = n.tenants) != null && i.beforeDelete && await n.tenants.beforeDelete(d, a), await t.env.data.tenants.remove(a), (c = n.tenants) != null && c.afterDelete && await n.tenants.afterDelete(d, a), t.body(null, 204);
   }), s;
 }
-function Y(t) {
-  const e = [
+function L(e) {
+  const n = [
     {
       pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
       type: "resource_server"
@@ -508,27 +552,27 @@ function Y(t) {
     { pattern: /\/api\/v2\/roles\/([^/]+)$/, type: "role" },
     { pattern: /\/api\/v2\/connections\/([^/]+)$/, type: "connection" }
   ];
-  for (const { pattern: s, type: n } of e) {
-    const a = t.match(s);
+  for (const { pattern: s, type: t } of n) {
+    const a = e.match(s);
     if (a && a[1])
-      return { type: n, id: a[1] };
+      return { type: t, id: a[1] };
   }
   return null;
 }
-async function B(t, e, s) {
+async function Y(e, n, s) {
   try {
     switch (s.type) {
       case "resource_server": {
-        const n = await t.resourceServers.get(e, s.id);
-        return (n == null ? void 0 : n.is_system) === !0;
+        const t = await e.resourceServers.get(n, s.id);
+        return (t == null ? void 0 : t.is_system) === !0;
       }
       case "role": {
-        const n = await t.roles.get(e, s.id);
-        return (n == null ? void 0 : n.is_system) === !0;
+        const t = await e.roles.get(n, s.id);
+        return (t == null ? void 0 : t.is_system) === !0;
       }
       case "connection": {
-        const n = await t.connections.get(e, s.id);
-        return (n == null ? void 0 : n.is_system) === !0;
+        const t = await e.connections.get(n, s.id);
+        return (t == null ? void 0 : t.is_system) === !0;
       }
       default:
         return !1;
@@ -537,100 +581,100 @@ async function B(t, e, s) {
     return !1;
   }
 }
-function Z(t) {
+function B(e) {
   return {
     resource_server: "resource server",
     role: "role",
     connection: "connection"
-  }[t];
+  }[e];
 }
-function J() {
-  return async (t, e) => {
-    if (!["PATCH", "PUT", "DELETE"].includes(t.req.method))
-      return e();
-    const s = Y(t.req.path);
+function Z() {
+  return async (e, n) => {
+    if (!["PATCH", "PUT", "DELETE"].includes(e.req.method))
+      return n();
+    const s = L(e.req.path);
     if (!s)
-      return e();
-    const n = t.var.tenant_id || t.req.header("x-tenant-id") || t.req.header("tenant-id");
-    if (!n)
-      return e();
-    if (await B(t.env.data, n, s))
+      return n();
+    const t = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
+    if (!t)
+      return n();
+    if (await Y(e.env.data, t, s))
       throw new p(403, {
-        message: `This ${Z(s.type)} is a system resource and cannot be modified. Make changes in the main tenant instead.`
+        message: `This ${B(s.type)} is a system resource and cannot be modified. Make changes in the main tenant instead.`
       });
-    return e();
+    return n();
   };
 }
-function X(t) {
-  return async (e, s) => {
-    if (!t.accessControl)
+function J(e) {
+  return async (n, s) => {
+    if (!e.accessControl)
       return s();
-    const n = e.var.tenant_id, a = e.var.organization_id;
-    if (!n)
+    const t = n.var.tenant_id, a = n.var.organization_id;
+    if (!t)
       throw new p(400, {
         message: "Tenant ID not found in request"
       });
     if (!E(
       a,
-      n,
-      t.accessControl.mainTenantId
+      t,
+      e.accessControl.mainTenantId
     ))
       throw new p(403, {
-        message: `Access denied to tenant ${n}`
+        message: `Access denied to tenant ${t}`
       });
     return s();
   };
 }
-function H(t) {
-  return async (e, s) => {
-    if (!t.subdomainRouting)
+function X(e) {
+  return async (n, s) => {
+    if (!e.subdomainRouting)
       return s();
     const {
-      baseDomain: n,
+      baseDomain: t,
       reservedSubdomains: a = [],
-      resolveSubdomain: c
-    } = t.subdomainRouting, d = e.req.header("host") || "";
-    let o = null;
-    if (d.endsWith(n)) {
-      const r = d.slice(0, -(n.length + 1));
-      r && !r.includes(".") && (o = r);
-    }
-    if (o && a.includes(o) && (o = null), !o)
-      return t.accessControl && e.set("tenant_id", t.accessControl.mainTenantId), s();
+      resolveSubdomain: o
+    } = e.subdomainRouting, d = n.req.header("host") || "";
     let i = null;
-    if (c)
-      i = await c(o);
-    else if (t.subdomainRouting.useOrganizations !== !1 && t.accessControl)
+    if (d.endsWith(t)) {
+      const r = d.slice(0, -(t.length + 1));
+      r && !r.includes(".") && (i = r);
+    }
+    if (i && a.includes(i) && (i = null), !i)
+      return e.accessControl && n.set("tenant_id", e.accessControl.mainTenantId), s();
+    let c = null;
+    if (o)
+      c = await o(i);
+    else if (e.subdomainRouting.useOrganizations !== !1 && e.accessControl)
       try {
-        const r = await e.env.data.organizations.get(
-          t.accessControl.mainTenantId,
-          o
+        const r = await n.env.data.organizations.get(
+          e.accessControl.mainTenantId,
+          i
         );
-        r && (i = r.id);
+        r && (c = r.id);
       } catch {
       }
-    if (!i)
+    if (!c)
       throw new p(404, {
-        message: `Tenant not found for subdomain: ${o}`
+        message: `Tenant not found for subdomain: ${i}`
       });
-    return e.set("tenant_id", i), s();
+    return n.set("tenant_id", c), s();
   };
 }
-function k(t) {
-  return async (e, s) => {
-    if (!t.databaseIsolation)
+function H(e) {
+  return async (n, s) => {
+    if (!e.databaseIsolation)
       return s();
-    const n = e.var.tenant_id;
-    if (!n)
+    const t = n.var.tenant_id;
+    if (!t)
       throw new p(400, {
         message: "Tenant ID not found in request"
       });
     try {
-      const a = await t.databaseIsolation.getAdapters(n);
-      e.env.data = a;
+      const a = await e.databaseIsolation.getAdapters(t);
+      n.env.data = a;
     } catch (a) {
       throw console.error(
-        `Failed to resolve database for tenant ${n}:`,
+        `Failed to resolve database for tenant ${t}:`,
         a
       ), new p(500, {
         message: "Failed to resolve tenant database"
@@ -639,188 +683,188 @@ function k(t) {
     return s();
   };
 }
-function I(t) {
-  const e = H(t), s = X(t), n = k(t);
-  return async (a, c) => (await e(a, async () => {
+function M(e) {
+  const n = X(e), s = J(e), t = H(e);
+  return async (a, o) => (await n(a, async () => {
   }), await s(a, async () => {
-  }), await n(a, async () => {
-  }), c());
+  }), await t(a, async () => {
+  }), o());
 }
-function re(t) {
-  const e = b(t);
+function re(e) {
+  const n = A(e);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
-    middleware: I(t),
+    middleware: M(e),
     // Provide lifecycle hooks
-    hooks: e,
+    hooks: n,
     // Mount tenant management routes
     routes: [
       {
         path: "/management",
-        handler: S(t, e)
+        handler: S(e, n)
       }
     ],
     // Called when plugin is registered
     onRegister: async () => {
-      console.log("Multi-tenancy plugin registered"), t.accessControl && console.log(
-        `  - Access control enabled (main tenant: ${t.accessControl.mainTenantId})`
-      ), t.subdomainRouting && console.log(
-        `  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`
-      ), t.databaseIsolation && console.log("  - Database isolation enabled");
+      console.log("Multi-tenancy plugin registered"), e.accessControl && console.log(
+        `  - Access control enabled (main tenant: ${e.accessControl.mainTenantId})`
+      ), e.subdomainRouting && console.log(
+        `  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`
+      ), e.databaseIsolation && console.log("  - Database isolation enabled");
     }
   };
 }
-function b(t) {
-  const e = t.accessControl ? O(t.accessControl) : {}, s = t.databaseIsolation ? K(t.databaseIsolation) : {}, n = N(t);
+function A(e) {
+  const n = e.accessControl ? j(e.accessControl) : {}, s = e.databaseIsolation ? K(e.databaseIsolation) : {}, t = N(e);
   return {
-    ...e,
+    ...n,
     ...s,
-    tenants: n
+    tenants: t
   };
 }
-function x(t) {
-  const e = new $(), s = b(t);
-  return e.route("/tenants", S(t, s)), e;
+function x(e) {
+  const n = new $(), s = A(e);
+  return n.route("/tenants", S(e, s)), n;
 }
-function ie(t) {
+function ie(e) {
   return {
-    hooks: b(t),
-    middleware: I(t),
-    app: x(t),
-    config: t
+    hooks: A(e),
+    middleware: M(e),
+    app: x(e),
+    config: e
   };
 }
-function oe(t) {
+function oe(e) {
   const {
-    mainTenantId: e = "main",
+    mainTenantId: n = "main",
     syncResourceServers: s = !0,
-    multiTenancy: n,
+    multiTenancy: t,
     entityHooks: a,
-    ...c
-  } = t, d = {
-    ...n,
+    ...o
+  } = e, d = {
+    ...t,
     accessControl: {
-      mainTenantId: e,
+      mainTenantId: n,
       requireOrganizationMatch: !1,
       defaultPermissions: ["tenant:admin"],
-      ...n == null ? void 0 : n.accessControl
+      ...t == null ? void 0 : t.accessControl
     }
-  }, o = b(d);
-  let i, r;
-  s && (i = G({
-    mainTenantId: e,
-    getChildTenantIds: async () => (await M(
-      (y) => t.dataAdapter.tenants.list(y),
+  }, i = A(d);
+  let c, r;
+  s && (c = V({
+    mainTenantId: n,
+    getChildTenantIds: async () => (await R(
+      (h) => e.dataAdapter.tenants.list(h),
       "tenants",
       { cursorField: "id", pageSize: 100 }
-    )).filter((y) => y.id !== e).map((y) => y.id),
-    getAdapters: async (g) => t.dataAdapter
-  }), r = L({
-    mainTenantId: e,
-    getMainTenantAdapters: async () => t.dataAdapter,
-    getAdapters: async (g) => t.dataAdapter
+    )).filter((h) => h.id !== n).map((h) => h.id),
+    getAdapters: async (y) => e.dataAdapter
+  }), r = G({
+    mainTenantId: n,
+    getMainTenantAdapters: async () => e.dataAdapter,
+    getAdapters: async (y) => e.dataAdapter
   }));
-  const l = async (g, y, ...h) => {
-    const v = [];
-    if (g)
+  const l = async (y, h, ...v) => {
+    const T = [];
+    if (y)
       try {
-        await g(...h);
-      } catch (A) {
-        v.push(A instanceof Error ? A : new Error(String(A)));
+        await y(...v);
+      } catch (b) {
+        T.push(b instanceof Error ? b : new Error(String(b)));
       }
-    if (y)
+    if (h)
       try {
-        await y(...h);
-      } catch (A) {
-        v.push(A instanceof Error ? A : new Error(String(A)));
+        await h(...v);
+      } catch (b) {
+        T.push(b instanceof Error ? b : new Error(String(b)));
       }
-    if (v.length === 1)
-      throw v[0];
-    if (v.length > 1)
+    if (T.length === 1)
+      throw T[0];
+    if (T.length > 1)
       throw new AggregateError(
-        v,
-        `Multiple hook errors: ${v.map((A) => A.message).join("; ")}`
+        T,
+        `Multiple hook errors: ${T.map((b) => b.message).join("; ")}`
       );
   }, f = {
     ...a,
-    resourceServers: i ? {
+    resourceServers: c ? {
       ...a == null ? void 0 : a.resourceServers,
-      afterCreate: async (g, y) => {
-        var h;
+      afterCreate: async (y, h) => {
+        var v;
         await l(
-          (h = a == null ? void 0 : a.resourceServers) == null ? void 0 : h.afterCreate,
-          i == null ? void 0 : i.afterCreate,
-          g,
-          y
+          (v = a == null ? void 0 : a.resourceServers) == null ? void 0 : v.afterCreate,
+          c == null ? void 0 : c.afterCreate,
+          y,
+          h
         );
       },
-      afterUpdate: async (g, y, h) => {
-        var v;
+      afterUpdate: async (y, h, v) => {
+        var T;
         await l(
-          (v = a == null ? void 0 : a.resourceServers) == null ? void 0 : v.afterUpdate,
-          i == null ? void 0 : i.afterUpdate,
-          g,
+          (T = a == null ? void 0 : a.resourceServers) == null ? void 0 : T.afterUpdate,
+          c == null ? void 0 : c.afterUpdate,
           y,
-          h
+          h,
+          v
         );
       },
-      afterDelete: async (g, y) => {
-        var h;
+      afterDelete: async (y, h) => {
+        var v;
         await l(
-          (h = a == null ? void 0 : a.resourceServers) == null ? void 0 : h.afterDelete,
-          i == null ? void 0 : i.afterDelete,
-          g,
-          y
+          (v = a == null ? void 0 : a.resourceServers) == null ? void 0 : v.afterDelete,
+          c == null ? void 0 : c.afterDelete,
+          y,
+          h
         );
       }
     } : a == null ? void 0 : a.resourceServers,
     tenants: r ? {
       ...a == null ? void 0 : a.tenants,
-      afterCreate: async (g, y) => {
-        var h;
+      afterCreate: async (y, h) => {
+        var v;
         await l(
-          (h = a == null ? void 0 : a.tenants) == null ? void 0 : h.afterCreate,
+          (v = a == null ? void 0 : a.tenants) == null ? void 0 : v.afterCreate,
           r == null ? void 0 : r.afterCreate,
-          g,
-          y
+          y,
+          h
         );
       }
     } : a == null ? void 0 : a.tenants
-  }, u = P({
-    ...c,
+  }, u = F({
+    ...o,
     entityHooks: f
-  }), { app: m, managementApp: T, ..._ } = u, w = new $();
-  w.use("/api/v2/*", J()), w.route("/", m);
-  const z = S(
+  }), { app: m, managementApp: _, ...g } = u, w = new $();
+  w.use("/api/v2/*", Z()), w.route("/", m);
+  const C = S(
     d,
-    o
+    i
   );
-  return w.route("/api/v2/tenants", z), {
+  return w.route("/api/v2/tenants", C), {
     app: w,
-    managementApp: T,
-    ..._,
+    managementApp: _,
+    ...g,
     multiTenancyConfig: d,
-    multiTenancyHooks: o
+    multiTenancyHooks: i
   };
 }
 export {
   le as MANAGEMENT_API_SCOPES,
-  O as createAccessControlHooks,
-  X as createAccessControlMiddleware,
+  j as createAccessControlHooks,
+  J as createAccessControlMiddleware,
   K as createDatabaseHooks,
-  k as createDatabaseMiddleware,
+  H as createDatabaseMiddleware,
   x as createMultiTenancy,
-  b as createMultiTenancyHooks,
-  I as createMultiTenancyMiddleware,
+  A as createMultiTenancyHooks,
+  M as createMultiTenancyMiddleware,
   re as createMultiTenancyPlugin,
-  J as createProtectSyncedMiddleware,
+  Z as createProtectSyncedMiddleware,
   N as createProvisioningHooks,
-  G as createResourceServerSyncHooks,
-  H as createSubdomainMiddleware,
-  L as createTenantResourceServerSyncHooks,
+  V as createResourceServerSyncHooks,
+  X as createSubdomainMiddleware,
+  G as createTenantResourceServerSyncHooks,
   S as createTenantsRouter,
-  M as fetchAll,
+  R as fetchAll,
   oe as init,
   ue as seed,
   ie as setupMultiTenancy,

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "13.5.0",
+  "version": "13.6.0",
   "description": "Multi-tenancy support for AuthHero with organization-based access control and per-tenant database isolation",
   "files": [
     "dist"
@@ -37,12 +37,12 @@
     "typescript": "^5.6.0",
     "vite": "^6.0.0",
     "vitest": "^2.1.0",
-    "@authhero/kysely-adapter": "10.71.0"
+    "@authhero/kysely-adapter": "10.72.0"
   },
   "dependencies": {
     "zod": "^3.24.0",
     "@authhero/adapter-interfaces": "0.112.0",
-    "authhero": "0.303.0"
+    "authhero": "0.304.0"
   },
   "peerDependencies": {
     "@hono/zod-openapi": "^0.19.10",