@authhero/multi-tenancy 14.0.0 → 14.2.0

package/dist/multi-tenancy.mjs

@@ -1,31 +1,31 @@
 var W = Object.defineProperty;
 var Q = (t, e, n) => e in t ? W(t, e, { enumerable: !0, configurable: !0, writable: !0, value: n }) : t[e] = n;
-var O = (t, e, n) => Q(t, typeof e != "symbol" ? e + "" : e, n);
-import { Hono as J } from "hono";
-import { MANAGEMENT_API_SCOPES as X, MANAGEMENT_API_AUDIENCE as U, fetchAll as z, init as Y } from "authhero";
-import { OpenAPIHono as Z, createRoute as R, z as I } from "@hono/zod-openapi";
-import { auth0QuerySchema as x, tenantSchema as N, tenantInsertSchema as ee, connectionSchema as D, connectionOptionsSchema as F } from "@authhero/adapter-interfaces";
-function te(t) {
+var $ = (t, e, n) => Q(t, typeof e != "symbol" ? e + "" : e, n);
+import { Hono as V } from "hono";
+import { MANAGEMENT_API_SCOPES as J, MANAGEMENT_API_AUDIENCE as L, fetchAll as I, init as X } from "authhero";
+import { OpenAPIHono as Y, createRoute as z, z as C } from "@hono/zod-openapi";
+import { auth0QuerySchema as Z, tenantSchema as k, tenantInsertSchema as x, connectionSchema as R, connectionOptionsSchema as O } from "@authhero/adapter-interfaces";
+function ee(t) {
   const { controlPlaneTenantId: e, requireOrganizationMatch: n = !0 } = t;
   return {
-    async onTenantAccessValidation(s, r) {
-      if (r === e)
+    async onTenantAccessValidation(s, a) {
+      if (a === e)
         return !0;
       if (n) {
-        const i = s.var.org_name, o = s.var.organization_id, a = i || o;
-        return a ? a.toLowerCase() === r.toLowerCase() : !1;
+        const i = s.var.org_name, o = s.var.organization_id, r = i || o;
+        return r ? r.toLowerCase() === a.toLowerCase() : !1;
       }
       return !0;
     }
   };
 }
-function ne(t, e, n, s) {
+function te(t, e, n, s) {
   if (e === n)
     return !0;
-  const r = s || t;
-  return r ? r.toLowerCase() === e.toLowerCase() : !1;
+  const a = s || t;
+  return a ? a.toLowerCase() === e.toLowerCase() : !1;
 }
-function se(t) {
+function ne(t) {
   return {
     async resolveDataAdapters(e) {
       try {
@@ -40,7 +40,7 @@ function se(t) {
     }
   };
 }
-function ae(t) {
+function se(t) {
   return `urn:authhero:tenant:${t.toLowerCase()}`;
 }
 function re(t) {
@@ -48,20 +48,20 @@ function re(t) {
     async beforeCreate(e, n) {
       return !n.audience && n.id ? {
         ...n,
-        audience: ae(n.id)
+        audience: se(n.id)
       } : n;
     },
     async afterCreate(e, n) {
-      const { accessControl: s, databaseIsolation: r } = t;
-      s && e.ctx && await oe(e, n, s), r != null && r.onProvision && await r.onProvision(n.id);
+      const { accessControl: s, databaseIsolation: a } = t;
+      s && e.ctx && await ae(e, n, s), a != null && a.onProvision && await a.onProvision(n.id);
     },
     async beforeDelete(e, n) {
-      const { accessControl: s, databaseIsolation: r } = t;
+      const { accessControl: s, databaseIsolation: a } = t;
       if (s)
         try {
           const o = (await e.adapters.organizations.list(
             s.controlPlaneTenantId
-          )).organizations.find((a) => a.name === n);
+          )).organizations.find((r) => r.name === n);
           o && await e.adapters.organizations.remove(
             s.controlPlaneTenantId,
             o.id
@@ -72,9 +72,9 @@ function re(t) {
             i
           );
         }
-      if (r != null && r.onDeprovision)
+      if (a != null && a.onDeprovision)
         try {
-          await r.onDeprovision(n);
+          await a.onDeprovision(n);
         } catch (i) {
           console.warn(
             `Failed to deprovision database for tenant ${n}:`,
@@ -84,16 +84,16 @@ function re(t) {
     }
   };
 }
-async function oe(t, e, n) {
+async function ae(t, e, n) {
   const {
     controlPlaneTenantId: s,
-    defaultPermissions: r,
+    defaultPermissions: a,
     defaultRoles: i,
     issuer: o,
-    adminRoleName: a = "Tenant Admin",
-    adminRoleDescription: u = "Full access to all tenant management operations",
-    addCreatorToOrganization: d = !0
-  } = n, c = await t.adapters.organizations.create(
+    adminRoleName: r = "Tenant Admin",
+    adminRoleDescription: c = "Full access to all tenant management operations",
+    addCreatorToOrganization: m = !0
+  } = n, l = await t.adapters.organizations.create(
     s,
     {
       name: e.id,
@@ -101,43 +101,43 @@ async function oe(t, e, n) {
     }
   );
   let f;
-  if (o && (f = await ce(
+  if (o && (f = await ie(
     t,
     s,
-    a,
-    u
-  )), d && t.ctx) {
-    const l = t.ctx.var.user;
-    if (l != null && l.sub && !await ie(
+    r,
+    c
+  )), m && t.ctx) {
+    const d = t.ctx.var.user;
+    if (d != null && d.sub && !await oe(
       t,
       s,
-      l.sub
+      d.sub
     ))
       try {
         await t.adapters.userOrganizations.create(s, {
-          user_id: l.sub,
-          organization_id: c.id
+          user_id: d.sub,
+          organization_id: l.id
         }), f && await t.adapters.userRoles.create(
           s,
-          l.sub,
+          d.sub,
           f,
-          c.id
+          l.id
           // organizationId
         );
-      } catch (w) {
+      } catch (p) {
         console.warn(
-          `Failed to add creator ${l.sub} to organization ${c.id}:`,
-          w
+          `Failed to add creator ${d.sub} to organization ${l.id}:`,
+          p
         );
       }
   }
   i && i.length > 0 && console.log(
-    `Would assign roles ${i.join(", ")} to organization ${c.id}`
-  ), r && r.length > 0 && console.log(
-    `Would grant permissions ${r.join(", ")} to organization ${c.id}`
+    `Would assign roles ${i.join(", ")} to organization ${l.id}`
+  ), a && a.length > 0 && console.log(
+    `Would grant permissions ${a.join(", ")} to organization ${l.id}`
   );
 }
-async function ie(t, e, n) {
+async function oe(t, e, n) {
   const s = await t.adapters.userRoles.list(
     e,
     n,
@@ -145,141 +145,132 @@ async function ie(t, e, n) {
     ""
     // Empty string for global roles
   );
-  for (const r of s)
+  for (const a of s)
     if ((await t.adapters.rolePermissions.list(
       e,
-      r.id,
+      a.id,
       { per_page: 1e3 }
     )).some(
-      (a) => a.permission_name === "admin:organizations"
+      (r) => r.permission_name === "admin:organizations"
     ))
       return !0;
   return !1;
 }
-async function ce(t, e, n, s) {
-  const i = (await t.adapters.roles.list(e, {})).roles.find((d) => d.name === n);
+async function ie(t, e, n, s) {
+  const i = (await t.adapters.roles.list(e, {})).roles.find((m) => m.name === n);
   if (i)
     return i.id;
   const o = await t.adapters.roles.create(e, {
     name: n,
     description: s
-  }), a = U, u = X.map((d) => ({
+  }), r = L, c = J.map((m) => ({
     role_id: o.id,
-    resource_server_identifier: a,
-    permission_name: d.value
+    resource_server_identifier: r,
+    permission_name: m.value
   }));
   return await t.adapters.rolePermissions.assign(
     e,
     o.id,
-    u
+    c
   ), o.id;
 }
-const le = [
-  "client_id",
-  "client_secret",
-  "app_secret",
-  "kid",
-  "team_id",
-  "twilio_sid",
-  "twilio_token"
-];
-function M(t, e, n = () => !0) {
-  const { controlPlaneTenantId: s, getChildTenantIds: r, getAdapters: i } = t, o = /* @__PURE__ */ new Map();
-  async function a(c, f, l) {
-    return (await e(c).list(f, {
-      q: `name:${l}`,
+function E(t, e, n = () => !0) {
+  const { controlPlaneTenantId: s, getChildTenantIds: a, getAdapters: i } = t, o = /* @__PURE__ */ new Map();
+  async function r(l, f, d) {
+    return (await e(l).list(f, {
+      q: `name:${d}`,
       per_page: 1
     }))[0] ?? null;
   }
-  async function u(c) {
-    const f = await r(), l = e(await i(s));
+  async function c(l) {
+    const f = await a(), d = e(await i(s));
     await Promise.all(
-      f.map(async (m) => {
+      f.map(async (u) => {
         try {
-          const w = await i(m), g = e(w), h = {
-            ...l.transform(c),
+          const p = await i(u), g = e(p), w = {
+            ...d.transform(l),
             is_system: !0
-          }, y = await a(w, m, c.name), v = y ? g.getId(y) : void 0;
-          if (y && v) {
-            const b = g.preserveOnUpdate ? g.preserveOnUpdate(y, h) : h;
-            await g.update(m, v, b);
+          }, A = await r(p, u, l.name), v = A ? g.getId(A) : void 0;
+          if (A && v) {
+            const h = g.preserveOnUpdate ? g.preserveOnUpdate(A, w) : w;
+            await g.update(u, v, h);
           } else
-            await g.create(m, h);
-        } catch (w) {
+            await g.create(u, w);
+        } catch (p) {
           console.error(
-            `Failed to sync ${l.listKey} "${c.name}" to tenant "${m}":`,
-            w
+            `Failed to sync ${d.listKey} "${l.name}" to tenant "${u}":`,
+            p
           );
         }
       })
     );
   }
-  async function d(c) {
-    const f = await r();
+  async function m(l) {
+    const f = await a();
     await Promise.all(
-      f.map(async (l) => {
+      f.map(async (d) => {
         try {
-          const m = await i(l), w = e(m), g = await a(m, l, c), p = g ? w.getId(g) : void 0;
-          g && p && await w.remove(l, p);
-        } catch (m) {
+          const u = await i(d), p = e(u), g = await r(u, d, l), y = g ? p.getId(g) : void 0;
+          g && y && await p.remove(d, y);
+        } catch (u) {
           console.error(
-            `Failed to delete entity "${c}" from tenant "${l}":`,
-            m
+            `Failed to delete entity "${l}" from tenant "${d}":`,
+            u
           );
         }
       })
     );
   }
   return {
-    afterCreate: async (c, f) => {
-      c.tenantId === s && n(f) && await u(f);
+    afterCreate: async (l, f) => {
+      l.tenantId === s && n(f) && await c(f);
     },
-    afterUpdate: async (c, f, l) => {
-      c.tenantId === s && n(l) && await u(l);
+    afterUpdate: async (l, f, d) => {
+      l.tenantId === s && n(d) && await c(d);
     },
-    beforeDelete: async (c, f) => {
-      if (c.tenantId !== s) return;
-      const m = await e(c.adapters).get(c.tenantId, f);
-      m && n(m) && o.set(f, m);
+    beforeDelete: async (l, f) => {
+      if (l.tenantId !== s) return;
+      const u = await e(l.adapters).get(l.tenantId, f);
+      u && n(u) && o.set(f, u);
     },
-    afterDelete: async (c, f) => {
-      if (c.tenantId !== s) return;
-      const l = o.get(f);
-      l && (o.delete(f), await d(l.name));
+    afterDelete: async (l, f) => {
+      if (l.tenantId !== s) return;
+      const d = o.get(f);
+      d && (o.delete(f), await m(d.name));
     }
   };
 }
-function q(t, e, n = () => !0) {
-  const { controlPlaneTenantId: s, getControlPlaneAdapters: r, getAdapters: i } = t;
+function N(t, e, n = () => !0) {
+  const { controlPlaneTenantId: s, getControlPlaneAdapters: a, getAdapters: i } = t;
   return {
-    async afterCreate(o, a) {
-      if (a.id !== s)
+    async afterCreate(o, r) {
+      if (r.id !== s)
         try {
-          const u = await r(), d = await i(a.id), c = e(u), f = e(d), l = await z(
-            (m) => c.listPaginated(s, m),
-            c.listKey,
+          const c = await a(), m = await i(r.id), l = e(c), f = e(m), d = await I(
+            (u) => l.listPaginated(s, u),
+            l.listKey,
             { cursorField: "id", pageSize: 100 }
           );
           await Promise.all(
-            l.filter((m) => n(m)).map(async (m) => {
+            d.filter((u) => n(u)).map(async (u) => {
               try {
-                const w = c.transform(m);
-                await f.create(a.id, {
-                  ...w,
+                const p = l.transform(u);
+                await f.create(r.id, {
+                  ...p,
                   is_system: !0
                 });
-              } catch (w) {
+              } catch (p) {
                 console.error(
-                  `Failed to sync entity to new tenant "${a.id}":`,
-                  w
+                  `Failed to sync entity to new tenant "${r.id}":`,
+                  p
                 );
               }
             })
           );
-        } catch (u) {
+        } catch (c) {
           console.error(
-            `Failed to sync entities to new tenant "${a.id}":`,
-            u
+            `Failed to sync entities to new tenant "${r.id}":`,
+            c
           );
         }
     }
@@ -317,177 +308,125 @@ const H = (t) => ({
     name: e.name,
     description: e.description
   })
-}), L = (t) => ({
-  list: async (e, n) => (await t.connections.list(e, n)).connections,
-  listPaginated: (e, n) => t.connections.list(e, n),
-  get: (e, n) => t.connections.get(e, n),
-  create: (e, n) => t.connections.create(e, n),
-  update: (e, n, s) => t.connections.update(e, n, s),
-  remove: (e, n) => t.connections.remove(e, n),
-  listKey: "connections",
-  getId: (e) => e.id,
-  transform: (e) => {
-    const n = e.options ? { ...e.options } : {};
-    for (const s of le)
-      delete n[s];
-    return {
-      id: e.id,
-      name: e.name,
-      display_name: e.display_name,
-      strategy: e.strategy,
-      options: n,
-      response_type: e.response_type,
-      response_mode: e.response_mode,
-      is_domain_connection: e.is_domain_connection,
-      show_as_button: e.show_as_button,
-      metadata: e.metadata
-    };
-  },
-  preserveOnUpdate: (e, n) => {
-    const s = e.options || {};
-    return {
-      ...n,
-      options: {
-        ...n.options,
-        client_id: s.client_id,
-        client_secret: s.client_secret,
-        app_secret: s.app_secret,
-        kid: s.kid,
-        team_id: s.team_id,
-        twilio_sid: s.twilio_sid,
-        twilio_token: s.twilio_token
-      }
-    };
-  }
 });
-function de(t) {
-  const { sync: e = {}, filters: n = {} } = t, s = e.resourceServers ?? !0, r = e.roles ?? !0, i = e.connections ?? !0, o = s ? M(
+function ce(t) {
+  const { sync: e = {}, filters: n = {} } = t, s = e.resourceServers ?? !0, a = e.roles ?? !0, i = s ? E(
     t,
     H,
     n.resourceServers
-  ) : void 0, a = r ? M(
+  ) : void 0, o = a ? E(
     t,
     G,
     n.roles
-  ) : void 0, u = i ? M(
-    t,
-    L,
-    n.connections
-  ) : void 0, d = s ? q(
+  ) : void 0, r = s ? N(
     t,
     H,
     n.resourceServers
-  ) : void 0, c = r ? q(
+  ) : void 0, c = a ? N(
     t,
     G,
     n.roles
-  ) : void 0, f = i ? q(
-    t,
-    L,
-    n.connections
-  ) : void 0, l = r ? {
-    async afterCreate(g, p) {
-      var h;
-      if (p.id !== t.controlPlaneTenantId) {
-        await ((h = c == null ? void 0 : c.afterCreate) == null ? void 0 : h.call(c, g, p));
+  ) : void 0, m = a ? {
+    async afterCreate(d, u) {
+      var p;
+      if (u.id !== t.controlPlaneTenantId) {
+        await ((p = c == null ? void 0 : c.afterCreate) == null ? void 0 : p.call(c, d, u));
         try {
-          const y = await t.getControlPlaneAdapters(), v = await t.getAdapters(p.id), b = await z(
-            (_) => y.roles.list(
+          const g = await t.getControlPlaneAdapters(), y = await t.getAdapters(u.id), w = await I(
+            (v) => g.roles.list(
               t.controlPlaneTenantId,
-              _
+              v
             ),
             "roles",
             { cursorField: "id", pageSize: 100 }
-          ), S = /* @__PURE__ */ new Map();
-          for (const _ of b.filter(
-            (T) => {
-              var A;
-              return ((A = n.roles) == null ? void 0 : A.call(n, T)) ?? !0;
+          ), A = /* @__PURE__ */ new Map();
+          for (const v of w.filter(
+            (h) => {
+              var T;
+              return ((T = n.roles) == null ? void 0 : T.call(n, h)) ?? !0;
             }
           )) {
-            const T = await m(
-              v,
-              p.id,
-              _.name
+            const h = await l(
+              y,
+              u.id,
+              v.name
             );
-            T && S.set(_.name, T.id);
+            h && A.set(v.name, h.id);
           }
-          for (const _ of b.filter(
-            (T) => {
-              var A;
-              return ((A = n.roles) == null ? void 0 : A.call(n, T)) ?? !0;
+          for (const v of w.filter(
+            (h) => {
+              var T;
+              return ((T = n.roles) == null ? void 0 : T.call(n, h)) ?? !0;
             }
           )) {
-            const T = S.get(_.name);
-            if (T)
+            const h = A.get(v.name);
+            if (h)
               try {
-                const A = await y.rolePermissions.list(
+                const T = await g.rolePermissions.list(
                   t.controlPlaneTenantId,
-                  _.id,
+                  v.id,
                   {}
                 );
-                A.length > 0 && await v.rolePermissions.assign(
-                  p.id,
-                  T,
-                  A.map((P) => ({
-                    role_id: T,
-                    resource_server_identifier: P.resource_server_identifier,
-                    permission_name: P.permission_name
+                T.length > 0 && await y.rolePermissions.assign(
+                  u.id,
+                  h,
+                  T.map((_) => ({
+                    role_id: h,
+                    resource_server_identifier: _.resource_server_identifier,
+                    permission_name: _.permission_name
                   }))
                 );
-              } catch (A) {
+              } catch (T) {
                 console.error(
-                  `Failed to sync permissions for role "${_.name}" to tenant "${p.id}":`,
-                  A
+                  `Failed to sync permissions for role "${v.name}" to tenant "${u.id}":`,
+                  T
                 );
               }
           }
-        } catch (y) {
+        } catch (g) {
           console.error(
-            `Failed to sync role permissions to tenant "${p.id}":`,
-            y
+            `Failed to sync role permissions to tenant "${u.id}":`,
+            g
           );
         }
       }
     }
   } : void 0;
-  async function m(g, p, h) {
-    return (await g.roles.list(p, {
-      q: `name:${h}`,
+  async function l(d, u, p) {
+    return (await d.roles.list(u, {
+      q: `name:${p}`,
       per_page: 1
     })).roles[0] ?? null;
   }
   return {
     entityHooks: {
-      resourceServers: o,
-      roles: a,
-      connections: u
+      resourceServers: i,
+      roles: o
     },
     tenantHooks: {
-      async afterCreate(g, p) {
-        const h = [
-          d == null ? void 0 : d.afterCreate,
-          (l == null ? void 0 : l.afterCreate) ?? (c == null ? void 0 : c.afterCreate),
-          f == null ? void 0 : f.afterCreate
-        ], y = [];
-        for (const v of h)
-          if (v)
+      async afterCreate(d, u) {
+        const p = [
+          r == null ? void 0 : r.afterCreate,
+          (m == null ? void 0 : m.afterCreate) ?? (c == null ? void 0 : c.afterCreate)
+        ], g = [];
+        for (const y of p)
+          if (y)
             try {
-              await v(g, p);
-            } catch (b) {
-              y.push(b instanceof Error ? b : new Error(String(b)));
+              await y(d, u);
+            } catch (w) {
+              g.push(w instanceof Error ? w : new Error(String(w)));
             }
-        if (y.length === 1) throw y[0];
-        if (y.length > 1)
+        if (g.length === 1) throw g[0];
+        if (g.length > 1)
           throw new AggregateError(
-            y,
-            y.map((v) => v.message).join("; ")
+            g,
+            g.map((y) => y.message).join("; ")
           );
       }
     }
   };
 }
-var C = class extends Error {
+var b = class extends Error {
   /**
    * Creates an instance of `HTTPException`.
    * @param status - HTTP status code for the exception. Defaults to 500.
@@ -495,8 +434,8 @@ var C = class extends Error {
    */
   constructor(e = 500, n) {
     super(n == null ? void 0 : n.message, { cause: n == null ? void 0 : n.cause });
-    O(this, "res");
-    O(this, "status");
+    $(this, "res");
+    $(this, "status");
     this.res = n == null ? void 0 : n.res, this.status = e;
   }
   /**
@@ -513,15 +452,15 @@ var C = class extends Error {
     });
   }
 };
-function k(t, e) {
-  const n = new Z();
+function M(t, e) {
+  const n = new Y();
   return n.openapi(
-    R({
+    z({
       tags: ["tenants"],
       method: "get",
       path: "/",
       request: {
-        query: x
+        query: Z
       },
       security: [
         {
@@ -532,11 +471,11 @@ function k(t, e) {
         200: {
           content: {
             "application/json": {
-              schema: I.object({
-                tenants: I.array(N),
-                start: I.number().optional(),
-                limit: I.number().optional(),
-                length: I.number().optional()
+              schema: C.object({
+                tenants: C.array(k),
+                start: C.number().optional(),
+                limit: C.number().optional(),
+                length: C.number().optional()
               })
             }
           },
@@ -545,74 +484,74 @@ function k(t, e) {
       }
     }),
     async (s) => {
-      var m, w, g, p;
-      const r = s.req.valid("query"), { page: i, per_page: o, include_totals: a, q: u } = r, d = s.var.user, c = (d == null ? void 0 : d.permissions) || [];
-      if (c.includes("auth:read") || c.includes("admin:organizations")) {
-        const h = await s.env.data.tenants.list({
+      var u, p, g, y;
+      const a = s.req.valid("query"), { page: i, per_page: o, include_totals: r, q: c } = a, m = s.var.user, l = (m == null ? void 0 : m.permissions) || [];
+      if (l.includes("auth:read") || l.includes("admin:organizations")) {
+        const w = await s.env.data.tenants.list({
           page: i,
           per_page: o,
-          include_totals: a,
-          q: u
+          include_totals: r,
+          q: c
         });
-        return a ? s.json({
-          tenants: h.tenants,
-          start: ((m = h.totals) == null ? void 0 : m.start) ?? 0,
-          limit: ((w = h.totals) == null ? void 0 : w.limit) ?? o,
-          length: h.tenants.length
-        }) : s.json({ tenants: h.tenants });
+        return r ? s.json({
+          tenants: w.tenants,
+          start: ((u = w.totals) == null ? void 0 : u.start) ?? 0,
+          limit: ((p = w.totals) == null ? void 0 : p.limit) ?? o,
+          length: w.tenants.length
+        }) : s.json({ tenants: w.tenants });
       }
-      if (t.accessControl && (d != null && d.sub)) {
-        const h = t.accessControl.controlPlaneTenantId, v = (await z(
-          ($) => s.env.data.userOrganizations.listUserOrganizations(
-            h,
-            d.sub,
-            $
+      if (t.accessControl && (m != null && m.sub)) {
+        const w = t.accessControl.controlPlaneTenantId, v = (await I(
+          (P) => s.env.data.userOrganizations.listUserOrganizations(
+            w,
+            m.sub,
+            P
           ),
           "organizations"
-        )).map(($) => $.name);
+        )).map((P) => P.name);
         if (v.length === 0)
-          return a ? s.json({
+          return r ? s.json({
             tenants: [],
             start: 0,
             limit: o ?? 50,
             length: 0
           }) : s.json({ tenants: [] });
-        const b = v.length, S = i ?? 0, _ = o ?? 50, T = S * _, A = v.slice(T, T + _);
-        if (A.length === 0)
-          return a ? s.json({
+        const h = v.length, T = i ?? 0, _ = o ?? 50, S = T * _, D = v.slice(S, S + _);
+        if (D.length === 0)
+          return r ? s.json({
             tenants: [],
-            start: T,
+            start: S,
             limit: _,
-            length: b
+            length: h
           }) : s.json({ tenants: [] });
-        const P = A.map(($) => `id:${$}`).join(" OR "), V = u ? `(${P}) AND (${u})` : P, E = await s.env.data.tenants.list({
-          q: V,
+        const F = D.map((P) => `id:${P}`).join(" OR "), K = c ? `(${F}) AND (${c})` : F, j = await s.env.data.tenants.list({
+          q: K,
           per_page: _,
           include_totals: !1
           // We calculate totals from accessibleTenantIds
         });
-        return a ? s.json({
-          tenants: E.tenants,
-          start: T,
+        return r ? s.json({
+          tenants: j.tenants,
+          start: S,
           limit: _,
-          length: b
-        }) : s.json({ tenants: E.tenants });
+          length: h
+        }) : s.json({ tenants: j.tenants });
       }
-      const l = await s.env.data.tenants.list({
+      const d = await s.env.data.tenants.list({
         page: i,
         per_page: o,
-        include_totals: a,
-        q: u
+        include_totals: r,
+        q: c
       });
-      return a ? s.json({
-        tenants: l.tenants,
-        start: ((g = l.totals) == null ? void 0 : g.start) ?? 0,
-        limit: ((p = l.totals) == null ? void 0 : p.limit) ?? o,
-        length: l.tenants.length
-      }) : s.json({ tenants: l.tenants });
+      return r ? s.json({
+        tenants: d.tenants,
+        start: ((g = d.totals) == null ? void 0 : g.start) ?? 0,
+        limit: ((y = d.totals) == null ? void 0 : y.limit) ?? o,
+        length: d.tenants.length
+      }) : s.json({ tenants: d.tenants });
     }
   ), n.openapi(
-    R({
+    z({
       tags: ["tenants"],
       method: "post",
       path: "/",
@@ -620,7 +559,7 @@ function k(t, e) {
         body: {
           content: {
             "application/json": {
-              schema: ee
+              schema: x
             }
           }
         }
@@ -634,7 +573,7 @@ function k(t, e) {
         201: {
           content: {
             "application/json": {
-              schema: N
+              schema: k
             }
           },
           description: "Tenant created"
@@ -648,10 +587,10 @@ function k(t, e) {
       }
     }),
     async (s) => {
-      var u, d;
-      const r = s.var.user;
-      if (!(r != null && r.sub))
-        throw new C(401, {
+      var c, m;
+      const a = s.var.user;
+      if (!(a != null && a.sub))
+        throw new b(401, {
           message: "Authentication required to create tenants"
         });
       let i = s.req.valid("json");
@@ -659,18 +598,18 @@ function k(t, e) {
         adapters: s.env.data,
         ctx: s
       };
-      (u = e.tenants) != null && u.beforeCreate && (i = await e.tenants.beforeCreate(o, i));
-      const a = await s.env.data.tenants.create(i);
-      return (d = e.tenants) != null && d.afterCreate && await e.tenants.afterCreate(o, a), s.json(a, 201);
+      (c = e.tenants) != null && c.beforeCreate && (i = await e.tenants.beforeCreate(o, i));
+      const r = await s.env.data.tenants.create(i);
+      return (m = e.tenants) != null && m.afterCreate && await e.tenants.afterCreate(o, r), s.json(r, 201);
     }
   ), n.openapi(
-    R({
+    z({
       tags: ["tenants"],
       method: "delete",
       path: "/{id}",
       request: {
-        params: I.object({
-          id: I.string()
+        params: C.object({
+          id: C.string()
         })
       },
       security: [
@@ -691,43 +630,43 @@ function k(t, e) {
       }
     }),
     async (s) => {
-      var a, u;
-      const { id: r } = s.req.valid("param");
+      var r, c;
+      const { id: a } = s.req.valid("param");
       if (t.accessControl) {
-        const d = s.var.user, c = t.accessControl.controlPlaneTenantId;
-        if (!(d != null && d.sub))
-          throw new C(401, {
+        const m = s.var.user, l = t.accessControl.controlPlaneTenantId;
+        if (!(m != null && m.sub))
+          throw new b(401, {
             message: "Authentication required"
           });
-        if (r === c)
-          throw new C(403, {
+        if (a === l)
+          throw new b(403, {
             message: "Cannot delete the control plane"
           });
-        if (!(await z(
-          (m) => s.env.data.userOrganizations.listUserOrganizations(
-            c,
-            d.sub,
-            m
+        if (!(await I(
+          (u) => s.env.data.userOrganizations.listUserOrganizations(
+            l,
+            m.sub,
+            u
           ),
           "organizations"
-        )).some((m) => m.name === r))
-          throw new C(403, {
+        )).some((u) => u.name === a))
+          throw new b(403, {
             message: "Access denied to this tenant"
           });
       }
-      if (!await s.env.data.tenants.get(r))
-        throw new C(404, {
+      if (!await s.env.data.tenants.get(a))
+        throw new b(404, {
           message: "Tenant not found"
         });
       const o = {
         adapters: s.env.data,
         ctx: s
       };
-      return (a = e.tenants) != null && a.beforeDelete && await e.tenants.beforeDelete(o, r), await s.env.data.tenants.remove(r), (u = e.tenants) != null && u.afterDelete && await e.tenants.afterDelete(o, r), s.body(null, 204);
+      return (r = e.tenants) != null && r.beforeDelete && await e.tenants.beforeDelete(o, a), await s.env.data.tenants.remove(a), (c = e.tenants) != null && c.afterDelete && await e.tenants.afterDelete(o, a), s.body(null, 204);
     }
   ), n;
 }
-function ue(t) {
+function le(t) {
   const e = [
     {
       pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -737,13 +676,13 @@ function ue(t) {
     { pattern: /\/api\/v2\/connections\/([^/]+)$/, type: "connection" }
   ];
   for (const { pattern: n, type: s } of e) {
-    const r = t.match(n);
-    if (r && r[1])
-      return { type: s, id: r[1] };
+    const a = t.match(n);
+    if (a && a[1])
+      return { type: s, id: a[1] };
   }
   return null;
 }
-async function me(t, e, n) {
+async function de(t, e, n) {
   try {
     switch (n.type) {
       case "resource_server": {
@@ -765,63 +704,63 @@ async function me(t, e, n) {
     return !1;
   }
 }
-function fe(t) {
+function ue(t) {
   return {
     resource_server: "resource server",
     role: "role",
     connection: "connection"
   }[t];
 }
-function pe() {
+function me() {
   return async (t, e) => {
     if (!["PATCH", "PUT", "DELETE"].includes(t.req.method))
       return e();
-    const n = ue(t.req.path);
+    const n = le(t.req.path);
     if (!n)
       return e();
     const s = t.var.tenant_id || t.req.header("x-tenant-id") || t.req.header("tenant-id");
     if (!s)
       return e();
-    if (await me(t.env.data, s, n))
-      throw new C(403, {
-        message: `This ${fe(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
+    if (await de(t.env.data, s, n))
+      throw new b(403, {
+        message: `This ${ue(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return e();
   };
 }
-function B(t, e) {
+function U(t, e) {
   const { controlPlaneTenantId: n, controlPlaneClientId: s } = e;
   return {
     ...t,
     legacyClients: {
       ...t.legacyClients,
-      get: async (r) => {
+      get: async (a) => {
         var f;
-        const i = await t.legacyClients.get(r);
+        const i = await t.legacyClients.get(a);
         if (!i)
           return null;
-        const o = s ? await t.legacyClients.get(s) : void 0, a = await t.connections.list(
+        const o = s ? await t.legacyClients.get(s) : void 0, r = await t.connections.list(
           i.tenant.id
-        ), u = n ? await t.connections.list(n) : { connections: [] }, d = a.connections.map((l) => {
+        ), c = n ? await t.connections.list(n) : { connections: [] }, m = r.connections.map((d) => {
           var g;
-          const m = (g = u.connections) == null ? void 0 : g.find(
-            (p) => p.name === l.name
+          const u = (g = c.connections) == null ? void 0 : g.find(
+            (y) => y.strategy === d.strategy
           );
-          if (!(m != null && m.options))
-            return l;
-          const w = D.parse({
-            ...m || {},
-            ...l
+          if (!(u != null && u.options))
+            return d;
+          const p = R.parse({
+            ...u || {},
+            ...d
           });
-          return w.options = F.parse({
-            ...m.options || {},
-            ...l.options
-          }), w;
-        }).filter((l) => l), c = {
+          return p.options = O.parse({
+            ...u.options || {},
+            ...d.options
+          }), p;
+        }).filter((d) => d), l = {
           ...(o == null ? void 0 : o.tenant) || {},
           ...i.tenant
         };
-        return !i.tenant.audience && ((f = o == null ? void 0 : o.tenant) != null && f.audience) && (c.audience = o.tenant.audience), {
+        return !i.tenant.audience && ((f = o == null ? void 0 : o.tenant) != null && f.audience) && (l.audience = o.tenant.audience), {
           ...i,
           web_origins: [
             ...(o == null ? void 0 : o.web_origins) || [],
@@ -835,58 +774,58 @@ function B(t, e) {
             ...(o == null ? void 0 : o.callbacks) || [],
             ...i.callbacks || []
           ],
-          connections: d,
-          tenant: c
+          connections: m,
+          tenant: l
         };
       }
     },
     connections: {
       ...t.connections,
-      get: async (r, i) => {
+      get: async (a, i) => {
+        var l;
         const o = await t.connections.get(
-          r,
+          a,
           i
         );
-        if (!o || !n)
+        if (!o || !n || a === n)
           return o;
-        const a = await t.connections.get(
-          n,
-          i
+        const c = (l = (await t.connections.list(n)).connections) == null ? void 0 : l.find(
+          (f) => f.strategy === o.strategy
         );
-        if (!a)
+        if (!(c != null && c.options))
           return o;
-        const u = D.parse({
-          ...a,
+        const m = R.parse({
+          ...c,
           ...o
         });
-        return u.options = F.parse({
-          ...a.options || {},
+        return m.options = O.parse({
+          ...c.options || {},
           ...o.options
-        }), u;
+        }), m;
       },
-      list: async (r, i) => {
-        const o = await t.connections.list(r, i);
-        if (!n || r === n)
+      list: async (a, i) => {
+        const o = await t.connections.list(a, i);
+        if (!n || a === n)
           return o;
-        const a = await t.connections.list(n), u = o.connections.map((d) => {
-          var l;
-          const c = (l = a.connections) == null ? void 0 : l.find(
-            (m) => m.name === d.name
+        const r = await t.connections.list(n), c = o.connections.map((m) => {
+          var d;
+          const l = (d = r.connections) == null ? void 0 : d.find(
+            (u) => u.strategy === m.strategy
           );
-          if (!(c != null && c.options))
-            return d;
-          const f = D.parse({
-            ...c,
-            ...d
+          if (!(l != null && l.options))
+            return m;
+          const f = R.parse({
+            ...l,
+            ...m
           });
-          return f.options = F.parse({
-            ...c.options || {},
-            ...d.options
+          return f.options = O.parse({
+            ...l.options || {},
+            ...m.options
           }), f;
         });
         return {
           ...o,
-          connections: u
+          connections: c
         };
       }
     }
@@ -899,66 +838,72 @@ function B(t, e) {
     // They remain part of ...baseAdapters and can be properly wrapped by caching.
   };
 }
-function ge(t, e) {
-  return B(t, e);
+function fe(t, e) {
+  return U(t, e);
 }
-const Ie = B, Se = ge;
-function we(t) {
+const Ce = U, Pe = fe;
+function ge(t) {
+  return async (e, n) => {
+    const s = e.var.user;
+    return (s == null ? void 0 : s.tenant_id) === t && s.org_name && e.set("tenant_id", s.org_name), n();
+  };
+}
+function pe(t) {
   return async (e, n) => {
     if (!t.accessControl)
       return n();
-    const { controlPlaneTenantId: s } = t.accessControl, r = e.var.org_name, i = e.var.organization_id, o = r || i;
-    let a = e.var.tenant_id;
-    const u = e.var.user, c = (u != null && u.aud ? Array.isArray(u.aud) ? u.aud : [u.aud] : []).includes(U);
-    if (!a && o && c && (e.set("tenant_id", o), a = o), !a)
-      throw new C(400, {
+    const { controlPlaneTenantId: s } = t.accessControl, a = e.var.org_name, i = e.var.organization_id, o = a || i;
+    let r = e.var.tenant_id;
+    const c = e.var.user, l = (c != null && c.aud ? Array.isArray(c.aud) ? c.aud : [c.aud] : []).includes(L);
+    if (!r && o && l && (e.set("tenant_id", o), r = o), !r)
+      throw new b(400, {
         message: "Tenant ID not found in request"
       });
-    if (!ne(
+    if (!te(
       i,
-      a,
+      r,
       s,
-      r
+      a
     ))
-      throw new C(403, {
-        message: `Access denied to tenant ${a}`
+      throw new b(403, {
+        message: `Access denied to tenant ${r}`
       });
     return n();
   };
 }
-function he(t) {
+function we(t) {
   return async (e, n) => {
     if (!t.subdomainRouting)
       return n();
     const {
       baseDomain: s,
-      reservedSubdomains: r = [],
+      reservedSubdomains: a = [],
       resolveSubdomain: i
     } = t.subdomainRouting, o = e.req.header("host") || "";
-    let a = null;
+    let r = null;
     if (o.endsWith(s)) {
-      const d = o.slice(0, -(s.length + 1));
-      d && !d.includes(".") && (a = d);
+      const m = o.slice(0, -(s.length + 1));
+      m && !m.includes(".") && (r = m);
     }
-    if (a && r.includes(a) && (a = null), !a)
+    if (r && a.includes(r) && (r = null), !r)
       return t.accessControl && e.set("tenant_id", t.accessControl.controlPlaneTenantId), n();
-    let u = null;
+    let c = null;
     if (i)
-      u = await i(a);
+      c = await i(r);
     else if (t.subdomainRouting.useOrganizations !== !1 && t.accessControl)
       try {
-        const d = await e.env.data.organizations.get(
+        const m = await e.env.data.organizations.get(
           t.accessControl.controlPlaneTenantId,
-          a
+          r
         );
-        d && (u = d.id);
+        m && (c = m.id);
       } catch {
       }
-    if (!u)
-      throw new C(404, {
-        message: `Tenant not found for subdomain: ${a}`
+    if (!c)
+      throw new b(404, {
+        message: `Tenant not found for subdomain: ${r}`
       });
-    return e.set("tenant_id", u), n();
+    return e.set("tenant_id", c), n();
   };
 }
 function ye(t) {
@@ -967,101 +912,97 @@ function ye(t) {
       return n();
     const s = e.var.tenant_id;
     if (!s)
-      throw new C(400, {
+      throw new b(400, {
         message: "Tenant ID not found in request"
       });
     try {
-      const r = await t.databaseIsolation.getAdapters(s);
-      e.env.data = r;
-    } catch (r) {
+      const a = await t.databaseIsolation.getAdapters(s);
+      e.env.data = a;
+    } catch (a) {
       throw console.error(
         `Failed to resolve database for tenant ${s}:`,
-        r
-      ), new C(500, {
+        a
+      ), new b(500, {
         message: "Failed to resolve tenant database"
       });
     }
     return n();
   };
 }
-function K(t) {
-  const e = he(t), n = we(t), s = ye(t);
-  return async (r, i) => (await e(r, async () => {
-  }), await n(r, async () => {
-  }), await s(r, async () => {
+function B(t) {
+  const e = we(t), n = pe(t), s = ye(t);
+  return async (a, i) => (await e(a, async () => {
+  }), await n(a, async () => {
+  }), await s(a, async () => {
   }), i());
 }
-function Pe(t) {
+function Ie(t) {
   const {
     dataAdapter: e,
     controlPlaneTenantId: n = "control_plane",
-    sync: s = { resourceServers: !0, roles: !0, connections: !0 },
-    defaultPermissions: r = ["tenant:admin"],
+    sync: s = { resourceServers: !0, roles: !0 },
+    defaultPermissions: a = ["tenant:admin"],
     requireOrganizationMatch: i = !1,
     managementApiExtensions: o = [],
-    entityHooks: a,
-    getChildTenantIds: u,
-    getAdapters: d,
-    ...c
-  } = t, f = s !== !1, l = f ? {
+    entityHooks: r,
+    getChildTenantIds: c,
+    getAdapters: m,
+    ...l
+  } = t, f = s !== !1, d = f ? {
     resourceServers: s.resourceServers ?? !0,
-    roles: s.roles ?? !0,
-    connections: s.connections ?? !0
-  } : { resourceServers: !1, roles: !1, connections: !1 }, g = {
+    roles: s.roles ?? !0
+  } : { resourceServers: !1, roles: !1 }, g = {
     controlPlaneTenantId: n,
-    getChildTenantIds: u ?? (async () => (await z(
+    getChildTenantIds: c ?? (async () => (await I(
       (_) => e.tenants.list(_),
       "tenants",
       { cursorField: "id", pageSize: 100 }
     )).filter((_) => _.id !== n).map((_) => _.id)),
-    getAdapters: d ?? (async () => e),
+    getAdapters: m ?? (async () => e),
     getControlPlaneAdapters: async () => e,
-    sync: l
-  }, { entityHooks: p, tenantHooks: h } = de(g), y = {
+    sync: d
+  }, { entityHooks: y, tenantHooks: w } = ce(g), A = {
     resourceServers: [
-      p.resourceServers,
-      ...(a == null ? void 0 : a.resourceServers) ?? []
+      y.resourceServers,
+      ...(r == null ? void 0 : r.resourceServers) ?? []
     ],
-    roles: [p.roles, ...(a == null ? void 0 : a.roles) ?? []],
-    connections: [
-      p.connections,
-      ...(a == null ? void 0 : a.connections) ?? []
-    ],
-    tenants: (a == null ? void 0 : a.tenants) ?? [],
-    rolePermissions: (a == null ? void 0 : a.rolePermissions) ?? []
-  }, v = k(
+    roles: [y.roles, ...(r == null ? void 0 : r.roles) ?? []],
+    connections: (r == null ? void 0 : r.connections) ?? [],
+    tenants: (r == null ? void 0 : r.tenants) ?? [],
+    rolePermissions: (r == null ? void 0 : r.rolePermissions) ?? []
+  }, v = M(
     {
       accessControl: {
         controlPlaneTenantId: n,
         requireOrganizationMatch: i,
-        defaultPermissions: r
+        defaultPermissions: a
       }
     },
-    { tenants: h }
-  ), { app: b } = Y({
+    { tenants: w }
+  ), { app: h } = X({
     dataAdapter: e,
-    ...c,
-    entityHooks: y,
+    ...l,
+    entityHooks: A,
     managementApiExtensions: [
       ...o,
       { path: "/tenants", router: v }
     ]
   });
-  return f && b.use("/api/v2/*", pe()), { app: b, controlPlaneTenantId: n };
+  return h.use("/api/v2/*", ge(n)), f && h.use("/api/v2/*", me()), { app: h, controlPlaneTenantId: n };
 }
-function $e(t) {
-  const e = j(t);
+function Se(t) {
+  const e = q(t);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
-    middleware: K(t),
+    middleware: B(t),
     // Provide lifecycle hooks
     hooks: e,
     // Mount tenant management routes
     routes: [
       {
         path: "/management",
-        handler: k(t, e)
+        handler: M(t, e)
       }
     ],
     // Called when plugin is registered
@@ -1074,45 +1015,46 @@ function $e(t) {
     }
   };
 }
-function j(t) {
-  const e = t.accessControl ? te(t.accessControl) : {}, n = t.databaseIsolation ? se(t.databaseIsolation) : {}, s = re(t);
+function q(t) {
+  const e = t.accessControl ? ee(t.accessControl) : {}, n = t.databaseIsolation ? ne(t.databaseIsolation) : {}, s = re(t);
   return {
     ...e,
     ...n,
     tenants: s
   };
 }
-function _e(t) {
-  const e = new J(), n = j(t);
-  return e.route("/tenants", k(t, n)), e;
+function he(t) {
+  const e = new V(), n = q(t);
+  return e.route("/tenants", M(t, n)), e;
 }
-function ze(t) {
+function $e(t) {
   return {
-    hooks: j(t),
-    middleware: K(t),
-    app: _e(t),
+    hooks: q(t),
+    middleware: B(t),
+    app: he(t),
     config: t
   };
 }
 export {
-  te as createAccessControlHooks,
-  we as createAccessControlMiddleware,
-  se as createDatabaseHooks,
+  ee as createAccessControlHooks,
+  pe as createAccessControlMiddleware,
+  ge as createControlPlaneTenantMiddleware,
+  ne as createDatabaseHooks,
   ye as createDatabaseMiddleware,
-  _e as createMultiTenancy,
-  j as createMultiTenancyHooks,
-  K as createMultiTenancyMiddleware,
-  $e as createMultiTenancyPlugin,
-  pe as createProtectSyncedMiddleware,
+  he as createMultiTenancy,
+  q as createMultiTenancyHooks,
+  B as createMultiTenancyMiddleware,
+  Se as createMultiTenancyPlugin,
+  me as createProtectSyncedMiddleware,
   re as createProvisioningHooks,
-  B as createRuntimeFallbackAdapter,
-  Ie as createSettingsInheritanceAdapter,
-  he as createSubdomainMiddleware,
-  de as createSyncHooks,
-  k as createTenantsOpenAPIRouter,
-  Pe as initMultiTenant,
-  ze as setupMultiTenancy,
-  ne as validateTenantAccess,
-  ge as withRuntimeFallback,
-  Se as withSettingsInheritance
+  U as createRuntimeFallbackAdapter,
+  Ce as createSettingsInheritanceAdapter,
+  we as createSubdomainMiddleware,
+  ce as createSyncHooks,
+  M as createTenantsOpenAPIRouter,
+  Ie as initMultiTenant,
+  $e as setupMultiTenancy,
+  te as validateTenantAccess,
+  fe as withRuntimeFallback,
+  Pe as withSettingsInheritance
 };