@authhero/multi-tenancy 14.10.0 → 14.11.0

package/dist/multi-tenancy.cjs

@@ -1 +1 @@
-"use strict";var se=Object.defineProperty;var oe=(e,t,n)=>t in e?se(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n;var D=(e,t,n)=>oe(e,typeof t!="symbol"?t+"":t,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const ie=require("hono"),T=require("authhero"),I=require("@hono/zod-openapi");function K(e){const{controlPlaneTenantId:t,requireOrganizationMatch:n=!0}=e;return{async onTenantAccessValidation(r,a){if(a===t)return!0;if(n){const s=r.var.org_name,o=r.var.organization_id,i=s||o;return i?i.toLowerCase()===a.toLowerCase():!1}return!0}}}function Q(e,t,n,r){if(t===n)return!0;const a=r||e;return a?a.toLowerCase()===t.toLowerCase():!1}function V(e){return{async resolveDataAdapters(t){try{return await e.getAdapters(t)}catch(n){console.error(`Failed to resolve data adapters for tenant ${t}:`,n);return}}}}function ce(e){return`urn:authhero:tenant:${e.toLowerCase()}`}function J(e){return{async beforeCreate(t,n){return!n.audience&&n.id?{...n,audience:ce(n.id)}:n},async afterCreate(t,n){const{accessControl:r,databaseIsolation:a}=e;r&&t.ctx&&await le(t,n,r),a!=null&&a.onProvision&&await a.onProvision(n.id)},async beforeDelete(t,n){const{accessControl:r,databaseIsolation:a}=e;if(r)try{const o=(await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find(i=>i.name===n);o&&await t.adapters.organizations.remove(r.controlPlaneTenantId,o.id)}catch(s){console.warn(`Failed to remove organization for tenant ${n}:`,s)}if(a!=null&&a.onDeprovision)try{await a.onDeprovision(n)}catch(s){console.warn(`Failed to deprovision database for tenant ${n}:`,s)}}}}async function le(e,t,n){const{controlPlaneTenantId:r,defaultPermissions:a,defaultRoles:s,issuer:o,adminRoleName:i="Tenant Admin",adminRoleDescription:u="Full access to all tenant management operations",addCreatorToOrganization:c=!0}=n,l=await e.adapters.organizations.create(r,{name:t.id,display_name:t.friendly_name||t.id});let g;if(o&&(g=await de(e,r,i,u)),c&&e.ctx){const d=e.ctx.var.user;if(d!=null&&d.sub&&!await ue(e,r,d.sub))try{await e.adapters.userOrganizations.create(r,{user_id:d.sub,organization_id:l.id}),g&&await e.adapters.userRoles.create(r,d.sub,g,l.id)}catch(m){console.warn(`Failed to add creator ${d.sub} to organization ${l.id}:`,m)}}s&&s.length>0&&console.log(`Would assign roles ${s.join(", ")} to organization ${l.id}`),a&&a.length>0&&console.log(`Would grant permissions ${a.join(", ")} to organization ${l.id}`)}async function ue(e,t,n){const r=await e.adapters.userRoles.list(t,n,void 0,"");for(const a of r)if((await e.adapters.rolePermissions.list(t,a.id,{per_page:1e3})).some(i=>i.permission_name==="admin:organizations"))return!0;return!1}async function de(e,t,n,r){const s=(await e.adapters.roles.list(t,{})).roles.find(c=>c.name===n);if(s)return s.id;const o=await e.adapters.roles.create(t,{name:n,description:r}),i=T.MANAGEMENT_API_AUDIENCE,u=T.MANAGEMENT_API_SCOPES.map(c=>({role_id:o.id,resource_server_identifier:i,permission_name:c.value}));return await e.adapters.rolePermissions.assign(t,o.id,u),o.id}function H(e,t,n=()=>!0){const{controlPlaneTenantId:r,getChildTenantIds:a,getAdapters:s}=e,o=new Map;async function i(l,g,d){return(await t(l).list(g,{q:`name:${d}`,per_page:1}))[0]??null}async function u(l){const g=await a(),d=t(await s(r));await Promise.all(g.map(async f=>{try{const m=await s(f),w=t(m),p={...d.transform(l),is_system:!0},y=await i(m,f,l.name),_=y?w.getId(y):void 0;if(y&&_){const C=w.preserveOnUpdate?w.preserveOnUpdate(y,p):p;await w.update(f,_,C)}else await w.create(f,p)}catch(m){console.error(`Failed to sync ${d.listKey} "${l.name}" to tenant "${f}":`,m)}}))}async function c(l){const g=await a();await Promise.all(g.map(async d=>{try{const f=await s(d),m=t(f),w=await i(f,d,l),h=w?m.getId(w):void 0;w&&h&&await m.remove(d,h)}catch(f){console.error(`Failed to delete entity "${l}" from tenant "${d}":`,f)}}))}return{afterCreate:async(l,g)=>{l.tenantId===r&&n(g)&&await u(g)},afterUpdate:async(l,g,d)=>{l.tenantId===r&&n(d)&&await u(d)},beforeDelete:async(l,g)=>{if(l.tenantId!==r)return;const f=await t(l.adapters).get(l.tenantId,g);f&&n(f)&&o.set(g,f)},afterDelete:async(l,g)=>{if(l.tenantId!==r)return;const d=o.get(g);d&&(o.delete(g),await c(d.name))}}}function G(e,t,n=()=>!0){const{controlPlaneTenantId:r,getControlPlaneAdapters:a,getAdapters:s}=e;return{async afterCreate(o,i){if(i.id!==r)try{const u=await a(),c=await s(i.id),l=t(u),g=t(c),d=await T.fetchAll(f=>l.listPaginated(r,f),l.listKey,{cursorField:"id",pageSize:100});await Promise.all(d.filter(f=>n(f)).map(async f=>{try{const m=l.transform(f);await g.create(i.id,{...m,is_system:!0})}catch(m){console.error(`Failed to sync entity to new tenant "${i.id}":`,m)}}))}catch(u){console.error(`Failed to sync entities to new tenant "${i.id}":`,u)}}}}const B=e=>({list:async(t,n)=>(await e.resourceServers.list(t,n)).resource_servers,listPaginated:(t,n)=>e.resourceServers.list(t,n),get:(t,n)=>e.resourceServers.get(t,n),create:(t,n)=>e.resourceServers.create(t,n),update:(t,n,r)=>e.resourceServers.update(t,n,r),remove:(t,n)=>e.resourceServers.remove(t,n),listKey:"resource_servers",getId:t=>t.id,transform:t=>({id:t.id,name:t.name,identifier:t.identifier,scopes:t.scopes,signing_alg:t.signing_alg,token_lifetime:t.token_lifetime,token_lifetime_for_web:t.token_lifetime_for_web})}),U=e=>({list:async(t,n)=>(await e.roles.list(t,n)).roles,listPaginated:(t,n)=>e.roles.list(t,n),get:(t,n)=>e.roles.get(t,n),create:(t,n)=>e.roles.create(t,n),update:(t,n,r)=>e.roles.update(t,n,r),remove:(t,n)=>e.roles.remove(t,n),listKey:"roles",getId:t=>t.id,transform:t=>({id:t.id,name:t.name,description:t.description})});function L(e){var t;return((t=e.metadata)==null?void 0:t.sync)!==!1}function X(e){const{sync:t={},filters:n={}}=e,r=t.resourceServers??!0,a=t.roles??!0,s=m=>L(m)?n.resourceServers?n.resourceServers(m):!0:!1,o=m=>L(m)?n.roles?n.roles(m):!0:!1,i=r?H(e,B,s):void 0,u=a?H(e,U,o):void 0,c=r?G(e,B,s):void 0,l=a?G(e,U,o):void 0,g=a?{async afterCreate(m,w){var h;if(w.id!==e.controlPlaneTenantId){await((h=l==null?void 0:l.afterCreate)==null?void 0:h.call(l,m,w));try{const p=await e.getControlPlaneAdapters(),y=await e.getAdapters(w.id),_=await T.fetchAll(P=>p.roles.list(e.controlPlaneTenantId,P),"roles",{cursorField:"id",pageSize:100}),C=new Map;for(const P of _.filter(v=>{var A;return((A=n.roles)==null?void 0:A.call(n,v))??!0})){const v=await d(y,w.id,P.name);v&&C.set(P.name,v.id)}for(const P of _.filter(v=>{var A;return((A=n.roles)==null?void 0:A.call(n,v))??!0})){const v=C.get(P.name);if(v)try{const A=await p.rolePermissions.list(e.controlPlaneTenantId,P.id,{});A.length>0&&await y.rolePermissions.assign(w.id,v,A.map(b=>({role_id:v,resource_server_identifier:b.resource_server_identifier,permission_name:b.permission_name})))}catch(A){console.error(`Failed to sync permissions for role "${P.name}" to tenant "${w.id}":`,A)}}}catch(p){console.error(`Failed to sync role permissions to tenant "${w.id}":`,p)}}}}:void 0;async function d(m,w,h){return(await m.roles.list(w,{q:`name:${h}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:i,roles:u},tenantHooks:{async afterCreate(m,w){const h=[c==null?void 0:c.afterCreate,(g==null?void 0:g.afterCreate)??(l==null?void 0:l.afterCreate)],p=[];for(const y of h)if(y)try{await y(m,w)}catch(_){p.push(_ instanceof Error?_:new Error(String(_)))}if(p.length===1)throw p[0];if(p.length>1)throw new AggregateError(p,p.map(y=>y.message).join("; "))}}}}var S=class extends Error{constructor(t=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});D(this,"res");D(this,"status");this.res=n==null?void 0:n.res,this.status=t}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function F(e,t){const n=new I.OpenAPIHono;return n.openapi(I.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:T.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:I.z.object({tenants:I.z.array(T.tenantSchema),start:I.z.number().optional(),limit:I.z.number().optional(),length:I.z.number().optional()})}},description:"List of tenants"}}}),async r=>{var m,w,h,p,y,_;const a=r.req.valid("query"),{page:s,per_page:o,include_totals:i,q:u}=a,c=r.var.user,l=(c==null?void 0:c.permissions)||[];if(l.includes("auth:read")||l.includes("admin:organizations")){const C=await r.env.data.tenants.list({page:s,per_page:o,include_totals:i,q:u});return i?r.json({tenants:C.tenants,start:((m=C.totals)==null?void 0:m.start)??0,limit:((w=C.totals)==null?void 0:w.limit)??o,length:C.tenants.length}):r.json({tenants:C.tenants})}const d=((h=e.accessControl)==null?void 0:h.controlPlaneTenantId)??((p=r.env.data.multiTenancyConfig)==null?void 0:p.controlPlaneTenantId);if(d&&(c!=null&&c.sub)){const P=(await T.fetchAll(R=>r.env.data.userOrganizations.listUserOrganizations(d,c.sub,R),"organizations")).map(R=>R.name);if(P.length===0)return i?r.json({tenants:[],start:0,limit:o??50,length:0}):r.json({tenants:[]});const v=P.length,A=s??0,b=o??50,z=A*b,M=P.slice(z,z+b);if(M.length===0)return i?r.json({tenants:[],start:z,limit:b,length:v}):r.json({tenants:[]});const E=M.map(R=>`id:${R}`).join(" OR "),ae=u?`(${E}) AND (${u})`:E,N=await r.env.data.tenants.list({q:ae,per_page:b,include_totals:!1});return i?r.json({tenants:N.tenants,start:z,limit:b,length:v}):r.json({tenants:N.tenants})}const f=await r.env.data.tenants.list({page:s,per_page:o,include_totals:i,q:u});return i?r.json({tenants:f.tenants,start:((y=f.totals)==null?void 0:y.start)??0,limit:((_=f.totals)==null?void 0:_.limit)??o,length:f.tenants.length}):r.json({tenants:f.tenants})}),n.openapi(I.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:T.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:T.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async r=>{var u,c;const a=r.var.user;if(!(a!=null&&a.sub))throw new S(401,{message:"Authentication required to create tenants"});let s=r.req.valid("json");const o={adapters:r.env.data,ctx:r};(u=t.tenants)!=null&&u.beforeCreate&&(s=await t.tenants.beforeCreate(o,s));const i=await r.env.data.tenants.create(s);return(c=t.tenants)!=null&&c.afterCreate&&await t.tenants.afterCreate(o,i),r.json(i,201)}),n.openapi(I.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:I.z.object({id:I.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async r=>{var u,c,l,g;const{id:a}=r.req.valid("param"),s=((u=e.accessControl)==null?void 0:u.controlPlaneTenantId)??((c=r.env.data.multiTenancyConfig)==null?void 0:c.controlPlaneTenantId);if(s){const d=r.var.user;if(!(d!=null&&d.sub))throw new S(401,{message:"Authentication required"});if(a===s)throw new S(403,{message:"Cannot delete the control plane"});if(!(await T.fetchAll(w=>r.env.data.userOrganizations.listUserOrganizations(s,d.sub,w),"organizations")).some(w=>w.name===a))throw new S(403,{message:"Access denied to this tenant"})}if(!await r.env.data.tenants.get(a))throw new S(404,{message:"Tenant not found"});const i={adapters:r.env.data,ctx:r};return(l=t.tenants)!=null&&l.beforeDelete&&await t.tenants.beforeDelete(i,a),await r.env.data.tenants.remove(a),(g=t.tenants)!=null&&g.afterDelete&&await t.tenants.afterDelete(i,a),r.body(null,204)}),n}function fe(e){const t=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:r}of t){const a=e.match(n);if(a&&a[1])return{type:r,id:a[1]}}return null}async function me(e,t,n){try{switch(n.type){case"resource_server":{const r=await e.resourceServers.get(t,n.id);return(r==null?void 0:r.is_system)===!0}case"role":{const r=await e.roles.get(t,n.id);return(r==null?void 0:r.is_system)===!0}case"connection":{const r=await e.connections.get(t,n.id);return(r==null?void 0:r.is_system)===!0}default:return!1}}catch{return!1}}function ge(e){return{resource_server:"resource server",role:"role",connection:"connection"}[e]}function Y(){return async(e,t)=>{if(!["PATCH","PUT","DELETE"].includes(e.req.method))return t();const n=fe(e.req.path);if(!n)return t();const r=e.var.tenant_id||e.req.header("x-tenant-id")||e.req.header("tenant-id");if(!r)return t();if(await me(e.env.data,r,n))throw new S(403,{message:`This ${ge(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return t()}}function q(e,t){const n=t.find(a=>a.strategy===e.strategy);if(!(n!=null&&n.options))return e;const r=T.connectionSchema.passthrough().parse({...n,...e});return r.options=T.connectionOptionsSchema.passthrough().parse({...n.options||{},...e.options}),r}function $(e,t){const n=[...t||[],...e||[]];return[...new Set(n)]}function W(e,t){return t?{...e,callbacks:$(e.callbacks,t.callbacks),web_origins:$(e.web_origins,t.web_origins),allowed_logout_urls:$(e.allowed_logout_urls,t.allowed_logout_urls),allowed_origins:$(e.allowed_origins,t.allowed_origins)}:e}function Z(e,t){const{controlPlaneTenantId:n,controlPlaneClientId:r}=t;return{...e,multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:r},connections:{...e.connections,get:async(a,s)=>{const o=await e.connections.get(a,s);if(!o||!n||a===n)return o;const i=await e.connections.list(n);return q(o,i.connections||[])},list:async(a,s)=>{const o=await e.connections.list(a,s);if(!n||a===n)return o;const i=await e.connections.list(n),u=o.connections.map(c=>q(c,i.connections||[]));return{...o,connections:u}}},clientConnections:{...e.clientConnections,listByClient:async(a,s)=>{let o=await e.clientConnections.listByClient(a,s);if(o.length===0&&(o=(await e.connections.list(a)).connections||[]),!n||a===n)return o;const i=await e.connections.list(n);return o.map(u=>q(u,i.connections||[]))}},clients:{...e.clients,get:async(a,s)=>{const o=await e.clients.get(a,s);if(!o)return null;if(!n||!r||a===n&&s===r)return o;const i=await e.clients.get(n,r);return W(o,i)},getByClientId:async a=>{const s=await e.clients.getByClientId(a);if(!s)return null;if(!n||!r||s.tenant_id===n&&s.client_id===r)return s;const o=await e.clients.get(n,r);return{...W(s,o),tenant_id:s.tenant_id}}},emailProviders:{...e.emailProviders,get:async a=>{const s=await e.emailProviders.get(a);return s||(!n||a===n?null:e.emailProviders.get(n))}}}}function k(e,t){return Z(e,t)}function x(e){return async(t,n)=>{const r=t.var.user;return(r==null?void 0:r.tenant_id)===e&&r.org_name&&t.set("tenant_id",r.org_name),n()}}function ee(e){return async(t,n)=>{if(!e.accessControl)return n();const{controlPlaneTenantId:r}=e.accessControl,a=t.var.org_name,s=t.var.organization_id,o=a||s;let i=t.var.tenant_id;const u=t.var.user,l=(u!=null&&u.aud?Array.isArray(u.aud)?u.aud:[u.aud]:[]).includes(T.MANAGEMENT_API_AUDIENCE);if(!i&&o&&l&&(t.set("tenant_id",o),i=o),!i)throw new S(400,{message:"Tenant ID not found in request"});if(!Q(s,i,r,a))throw new S(403,{message:`Access denied to tenant ${i}`});return n()}}function te(e){return async(t,n)=>{if(!e.subdomainRouting)return n();const{baseDomain:r,reservedSubdomains:a=[],resolveSubdomain:s}=e.subdomainRouting,o=t.req.header("host")||"";let i=null;if(o.endsWith(r)){const c=o.slice(0,-(r.length+1));c&&!c.includes(".")&&(i=c)}if(i&&a.includes(i)&&(i=null),!i)return e.accessControl&&t.set("tenant_id",e.accessControl.controlPlaneTenantId),n();let u=null;if(s)u=await s(i);else if(e.subdomainRouting.useOrganizations!==!1&&e.accessControl)try{const c=await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId,i);c&&(u=c.id)}catch{}if(!u)throw new S(404,{message:`Tenant not found for subdomain: ${i}`});return t.set("tenant_id",u),n()}}function ne(e){return async(t,n)=>{if(!e.databaseIsolation)return n();const r=t.var.tenant_id;if(!r)throw new S(400,{message:"Tenant ID not found in request"});try{const a=await e.databaseIsolation.getAdapters(r);t.env.data=a}catch(a){throw console.error(`Failed to resolve database for tenant ${r}:`,a),new S(500,{message:"Failed to resolve tenant database"})}return n()}}function j(e){const t=te(e),n=ee(e),r=ne(e);return async(a,s)=>(await t(a,async()=>{}),await n(a,async()=>{}),await r(a,async()=>{}),s())}function we(e){const{dataAdapter:t,controlPlane:n,controlPlane:{tenantId:r="control_plane",clientId:a}={},sync:s={resourceServers:!0,roles:!0},defaultPermissions:o=["tenant:admin"],requireOrganizationMatch:i=!1,managementApiExtensions:u=[],entityHooks:c,getChildTenantIds:l,getAdapters:g,...d}=e;let f=t,m=t;n&&(f=k(t,{controlPlaneTenantId:r,controlPlaneClientId:a}),m={...t,multiTenancyConfig:{controlPlaneTenantId:r,controlPlaneClientId:a}});const w=s!==!1,h=w?{resourceServers:s.resourceServers??!0,roles:s.roles??!0}:{resourceServers:!1,roles:!1},_={controlPlaneTenantId:r,getChildTenantIds:l??(async()=>(await T.fetchAll(M=>f.tenants.list(M),"tenants",{cursorField:"id",pageSize:100})).filter(M=>M.id!==r).map(M=>M.id)),getAdapters:g??(async()=>f),getControlPlaneAdapters:async()=>f,sync:h},{entityHooks:C,tenantHooks:P}=X(_),v={resourceServers:[C.resourceServers,...(c==null?void 0:c.resourceServers)??[]],roles:[C.roles,...(c==null?void 0:c.roles)??[]],connections:(c==null?void 0:c.connections)??[],tenants:(c==null?void 0:c.tenants)??[],rolePermissions:(c==null?void 0:c.rolePermissions)??[]},A=F({accessControl:{controlPlaneTenantId:r,requireOrganizationMatch:i,defaultPermissions:o}},{tenants:P}),{app:b}=T.init({dataAdapter:f,managementDataAdapter:m,...d,entityHooks:v,managementApiExtensions:[...u,{path:"/tenants",router:A}]});return b.use("/api/v2/*",x(r)),w&&b.use("/api/v2/*",Y()),{app:b,controlPlaneTenantId:r}}function pe(e){const t=O(e);return{name:"multi-tenancy",middleware:j(e),hooks:t,routes:[{path:"/management",handler:F(e,t)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),e.accessControl&&console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`),e.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`),e.databaseIsolation&&console.log("  - Database isolation enabled")}}}function O(e){const t=e.accessControl?K(e.accessControl):{},n=e.databaseIsolation?V(e.databaseIsolation):{},r=J(e);return{...t,...n,tenants:r}}function re(e){const t=new ie.Hono,n=O(e);return t.route("/tenants",F(e,n)),t}function ye(e){return{hooks:O(e),middleware:j(e),app:re(e),config:e,wrapAdapters:(t,n)=>{var r;return k(t,{controlPlaneTenantId:(r=e.accessControl)==null?void 0:r.controlPlaneTenantId,controlPlaneClientId:n==null?void 0:n.controlPlaneClientId})}}}exports.createAccessControlHooks=K;exports.createAccessControlMiddleware=ee;exports.createControlPlaneTenantMiddleware=x;exports.createDatabaseHooks=V;exports.createDatabaseMiddleware=ne;exports.createMultiTenancy=re;exports.createMultiTenancyHooks=O;exports.createMultiTenancyMiddleware=j;exports.createMultiTenancyPlugin=pe;exports.createProtectSyncedMiddleware=Y;exports.createProvisioningHooks=J;exports.createRuntimeFallbackAdapter=Z;exports.createSubdomainMiddleware=te;exports.createSyncHooks=X;exports.createTenantsOpenAPIRouter=F;exports.initMultiTenant=we;exports.setupMultiTenancy=ye;exports.validateTenantAccess=Q;exports.withRuntimeFallback=k;
+"use strict";var oe=Object.defineProperty;var ie=(e,t,n)=>t in e?oe(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n;var D=(e,t,n)=>ie(e,typeof t!="symbol"?t+"":t,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const ce=require("hono"),_=require("authhero"),I=require("@hono/zod-openapi");function Q(e){const{controlPlaneTenantId:t,requireOrganizationMatch:n=!0}=e;return{async onTenantAccessValidation(r,a){if(a===t)return!0;if(n){const s=r.var.org_name,o=r.var.organization_id,i=s||o;return i?i.toLowerCase()===a.toLowerCase():!1}return!0}}}function V(e,t,n,r){if(t===n)return!0;const a=r||e;return a?a.toLowerCase()===t.toLowerCase():!1}function J(e){return{async resolveDataAdapters(t){try{return await e.getAdapters(t)}catch(n){console.error(`Failed to resolve data adapters for tenant ${t}:`,n);return}}}}function le(e){return`urn:authhero:tenant:${e.toLowerCase()}`}function X(e){return{async beforeCreate(t,n){return!n.audience&&n.id?{...n,audience:le(n.id)}:n},async afterCreate(t,n){const{accessControl:r,databaseIsolation:a}=e;r&&t.ctx&&await ue(t,n,r),a!=null&&a.onProvision&&await a.onProvision(n.id)},async beforeDelete(t,n){const{accessControl:r,databaseIsolation:a}=e;if(r)try{const o=(await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find(i=>i.name===n);o&&await t.adapters.organizations.remove(r.controlPlaneTenantId,o.id)}catch(s){console.warn(`Failed to remove organization for tenant ${n}:`,s)}if(a!=null&&a.onDeprovision)try{await a.onDeprovision(n)}catch(s){console.warn(`Failed to deprovision database for tenant ${n}:`,s)}}}}async function ue(e,t,n){const{controlPlaneTenantId:r,defaultPermissions:a,defaultRoles:s,issuer:o,adminRoleName:i="Tenant Admin",adminRoleDescription:u="Full access to all tenant management operations",addCreatorToOrganization:c=!0}=n,l=await e.adapters.organizations.create(r,{name:t.id,display_name:t.friendly_name||t.id});let g;if(o&&(g=await fe(e,r,i,u)),c&&e.ctx){const d=e.ctx.var.user;if(d!=null&&d.sub&&!await de(e,r,d.sub))try{await e.adapters.userOrganizations.create(r,{user_id:d.sub,organization_id:l.id}),g&&await e.adapters.userRoles.create(r,d.sub,g,l.id)}catch(m){console.warn(`Failed to add creator ${d.sub} to organization ${l.id}:`,m)}}s&&s.length>0&&console.log(`Would assign roles ${s.join(", ")} to organization ${l.id}`),a&&a.length>0&&console.log(`Would grant permissions ${a.join(", ")} to organization ${l.id}`)}async function de(e,t,n){const r=await e.adapters.userRoles.list(t,n,void 0,"");for(const a of r)if((await e.adapters.rolePermissions.list(t,a.id,{per_page:1e3})).some(i=>i.permission_name==="admin:organizations"))return!0;return!1}async function fe(e,t,n,r){const s=(await e.adapters.roles.list(t,{})).roles.find(c=>c.name===n);if(s)return s.id;const o=await e.adapters.roles.create(t,{name:n,description:r}),i=_.MANAGEMENT_API_AUDIENCE,u=_.MANAGEMENT_API_SCOPES.map(c=>({role_id:o.id,resource_server_identifier:i,permission_name:c.value}));return await e.adapters.rolePermissions.assign(t,o.id,u),o.id}function H(e,t,n=()=>!0){const{controlPlaneTenantId:r,getChildTenantIds:a,getAdapters:s}=e,o=new Map;async function i(l,g,d){return(await t(l).list(g,{q:`name:${d}`,per_page:1}))[0]??null}async function u(l){const g=await a(),d=t(await s(r));await Promise.all(g.map(async f=>{try{const m=await s(f),w=t(m),p={...d.transform(l),is_system:!0},y=await i(m,f,l.name),T=y?w.getId(y):void 0;if(y&&T){const C=w.preserveOnUpdate?w.preserveOnUpdate(y,p):p;await w.update(f,T,C)}else await w.create(f,p)}catch(m){console.error(`Failed to sync ${d.listKey} "${l.name}" to tenant "${f}":`,m)}}))}async function c(l){const g=await a();await Promise.all(g.map(async d=>{try{const f=await s(d),m=t(f),w=await i(f,d,l),h=w?m.getId(w):void 0;w&&h&&await m.remove(d,h)}catch(f){console.error(`Failed to delete entity "${l}" from tenant "${d}":`,f)}}))}return{afterCreate:async(l,g)=>{l.tenantId===r&&n(g)&&await u(g)},afterUpdate:async(l,g,d)=>{l.tenantId===r&&n(d)&&await u(d)},beforeDelete:async(l,g)=>{if(l.tenantId!==r)return;const f=await t(l.adapters).get(l.tenantId,g);f&&n(f)&&o.set(g,f)},afterDelete:async(l,g)=>{if(l.tenantId!==r)return;const d=o.get(g);d&&(o.delete(g),await c(d.name))}}}function B(e,t,n=()=>!0){const{controlPlaneTenantId:r,getControlPlaneAdapters:a,getAdapters:s}=e;return{async afterCreate(o,i){if(i.id!==r)try{const u=await a(),c=await s(i.id),l=t(u),g=t(c),d=await _.fetchAll(f=>l.listPaginated(r,f),l.listKey,{cursorField:"id",pageSize:100});await Promise.all(d.filter(f=>n(f)).map(async f=>{try{const m=l.transform(f);await g.create(i.id,{...m,is_system:!0})}catch(m){console.error(`Failed to sync entity to new tenant "${i.id}":`,m)}}))}catch(u){console.error(`Failed to sync entities to new tenant "${i.id}":`,u)}}}}const G=e=>({list:async(t,n)=>(await e.resourceServers.list(t,n)).resource_servers,listPaginated:(t,n)=>e.resourceServers.list(t,n),get:(t,n)=>e.resourceServers.get(t,n),create:(t,n)=>e.resourceServers.create(t,n),update:(t,n,r)=>e.resourceServers.update(t,n,r),remove:(t,n)=>e.resourceServers.remove(t,n),listKey:"resource_servers",getId:t=>t.id,transform:t=>({id:t.id,name:t.name,identifier:t.identifier,scopes:t.scopes,signing_alg:t.signing_alg,token_lifetime:t.token_lifetime,token_lifetime_for_web:t.token_lifetime_for_web})}),U=e=>({list:async(t,n)=>(await e.roles.list(t,n)).roles,listPaginated:(t,n)=>e.roles.list(t,n),get:(t,n)=>e.roles.get(t,n),create:(t,n)=>e.roles.create(t,n),update:(t,n,r)=>e.roles.update(t,n,r),remove:(t,n)=>e.roles.remove(t,n),listKey:"roles",getId:t=>t.id,transform:t=>({id:t.id,name:t.name,description:t.description})});function L(e){var t;return((t=e.metadata)==null?void 0:t.sync)!==!1}function Y(e){const{sync:t={},filters:n={}}=e,r=t.resourceServers??!0,a=t.roles??!0,s=m=>L(m)?n.resourceServers?n.resourceServers(m):!0:!1,o=m=>L(m)?n.roles?n.roles(m):!0:!1,i=r?H(e,G,s):void 0,u=a?H(e,U,o):void 0,c=r?B(e,G,s):void 0,l=a?B(e,U,o):void 0,g=a?{async afterCreate(m,w){var h;if(w.id!==e.controlPlaneTenantId){await((h=l==null?void 0:l.afterCreate)==null?void 0:h.call(l,m,w));try{const p=await e.getControlPlaneAdapters(),y=await e.getAdapters(w.id),T=await _.fetchAll(P=>p.roles.list(e.controlPlaneTenantId,P),"roles",{cursorField:"id",pageSize:100}),C=new Map;for(const P of T.filter(v=>{var A;return((A=n.roles)==null?void 0:A.call(n,v))??!0})){const v=await d(y,w.id,P.name);v&&C.set(P.name,v.id)}for(const P of T.filter(v=>{var A;return((A=n.roles)==null?void 0:A.call(n,v))??!0})){const v=C.get(P.name);if(v)try{const A=await p.rolePermissions.list(e.controlPlaneTenantId,P.id,{});A.length>0&&await y.rolePermissions.assign(w.id,v,A.map(b=>({role_id:v,resource_server_identifier:b.resource_server_identifier,permission_name:b.permission_name})))}catch(A){console.error(`Failed to sync permissions for role "${P.name}" to tenant "${w.id}":`,A)}}}catch(p){console.error(`Failed to sync role permissions to tenant "${w.id}":`,p)}}}}:void 0;async function d(m,w,h){return(await m.roles.list(w,{q:`name:${h}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:i,roles:u},tenantHooks:{async afterCreate(m,w){const h=[c==null?void 0:c.afterCreate,(g==null?void 0:g.afterCreate)??(l==null?void 0:l.afterCreate)],p=[];for(const y of h)if(y)try{await y(m,w)}catch(T){p.push(T instanceof Error?T:new Error(String(T)))}if(p.length===1)throw p[0];if(p.length>1)throw new AggregateError(p,p.map(y=>y.message).join("; "))}}}}var S=class extends Error{constructor(t=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});D(this,"res");D(this,"status");this.res=n==null?void 0:n.res,this.status=t}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function F(e,t){const n=new I.OpenAPIHono;return n.openapi(I.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:_.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:I.z.object({tenants:I.z.array(_.tenantSchema),start:I.z.number().optional(),limit:I.z.number().optional(),length:I.z.number().optional()})}},description:"List of tenants"}}}),async r=>{var m,w,h,p,y,T;const a=r.req.valid("query"),{page:s,per_page:o,include_totals:i,q:u}=a,c=r.var.user,l=(c==null?void 0:c.permissions)||[];if(l.includes("auth:read")||l.includes("admin:organizations")){const C=await r.env.data.tenants.list({page:s,per_page:o,include_totals:i,q:u});return i?r.json({tenants:C.tenants,start:((m=C.totals)==null?void 0:m.start)??0,limit:((w=C.totals)==null?void 0:w.limit)??o,length:C.tenants.length}):r.json({tenants:C.tenants})}const d=((h=e.accessControl)==null?void 0:h.controlPlaneTenantId)??((p=r.env.data.multiTenancyConfig)==null?void 0:p.controlPlaneTenantId);if(d&&(c!=null&&c.sub)){const P=(await _.fetchAll(z=>r.env.data.userOrganizations.listUserOrganizations(d,c.sub,z),"organizations")).map(z=>z.name);if(P.length===0)return i?r.json({tenants:[],start:0,limit:o??50,length:0}):r.json({tenants:[]});const v=P.length,A=s??0,b=o??50,R=A*b,M=P.slice(R,R+b);if(M.length===0)return i?r.json({tenants:[],start:R,limit:b,length:v}):r.json({tenants:[]});const E=M.map(z=>`id:${z}`).join(" OR "),se=u?`(${E}) AND (${u})`:E,N=await r.env.data.tenants.list({q:se,per_page:b,include_totals:!1});return i?r.json({tenants:N.tenants,start:R,limit:b,length:v}):r.json({tenants:N.tenants})}const f=await r.env.data.tenants.list({page:s,per_page:o,include_totals:i,q:u});return i?r.json({tenants:f.tenants,start:((y=f.totals)==null?void 0:y.start)??0,limit:((T=f.totals)==null?void 0:T.limit)??o,length:f.tenants.length}):r.json({tenants:f.tenants})}),n.openapi(I.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:_.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:_.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async r=>{var u,c;const a=r.var.user;if(!(a!=null&&a.sub))throw new S(401,{message:"Authentication required to create tenants"});let s=r.req.valid("json");const o={adapters:r.env.data,ctx:r};(u=t.tenants)!=null&&u.beforeCreate&&(s=await t.tenants.beforeCreate(o,s));const i=await r.env.data.tenants.create(s);return(c=t.tenants)!=null&&c.afterCreate&&await t.tenants.afterCreate(o,i),r.json(i,201)}),n.openapi(I.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:I.z.object({id:I.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async r=>{var u,c,l,g;const{id:a}=r.req.valid("param"),s=((u=e.accessControl)==null?void 0:u.controlPlaneTenantId)??((c=r.env.data.multiTenancyConfig)==null?void 0:c.controlPlaneTenantId);if(s){const d=r.var.user;if(!(d!=null&&d.sub))throw new S(401,{message:"Authentication required"});if(a===s)throw new S(403,{message:"Cannot delete the control plane"});if(!(await _.fetchAll(w=>r.env.data.userOrganizations.listUserOrganizations(s,d.sub,w),"organizations")).some(w=>w.name===a))throw new S(403,{message:"Access denied to this tenant"})}if(!await r.env.data.tenants.get(a))throw new S(404,{message:"Tenant not found"});const i={adapters:r.env.data,ctx:r};return(l=t.tenants)!=null&&l.beforeDelete&&await t.tenants.beforeDelete(i,a),await r.env.data.tenants.remove(a),(g=t.tenants)!=null&&g.afterDelete&&await t.tenants.afterDelete(i,a),r.body(null,204)}),n}function me(e){const t=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:r}of t){const a=e.match(n);if(a&&a[1])return{type:r,id:a[1]}}return null}async function ge(e,t,n){try{switch(n.type){case"resource_server":{const r=await e.resourceServers.get(t,n.id);return(r==null?void 0:r.is_system)===!0}case"role":{const r=await e.roles.get(t,n.id);return(r==null?void 0:r.is_system)===!0}case"connection":{const r=await e.connections.get(t,n.id);return(r==null?void 0:r.is_system)===!0}default:return!1}}catch{return!1}}function we(e){return{resource_server:"resource server",role:"role",connection:"connection"}[e]}function Z(){return async(e,t)=>{if(!["PATCH","PUT","DELETE"].includes(e.req.method))return t();const n=me(e.req.path);if(!n)return t();const r=e.var.tenant_id||e.req.header("x-tenant-id")||e.req.header("tenant-id");if(!r)return t();if(await ge(e.env.data,r,n))throw new S(403,{message:`This ${we(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return t()}}function q(e,t){const n=t.find(a=>a.strategy===e.strategy);if(!(n!=null&&n.options))return e;const r=_.connectionSchema.passthrough().parse({...n,...e});return r.options=_.connectionOptionsSchema.passthrough().parse({...n.options||{},...e.options}),r}function $(e,t){const n=[...t||[],...e||[]];return[...new Set(n)]}function pe(e,t){if(!(t!=null&&t.length))return e||[];if(!(e!=null&&e.length))return t;const n=new Map;for(const r of t)n.set(r.value,r);for(const r of e)n.set(r.value,r);return Array.from(n.values())}function W(e,t){return t?{...e,scopes:pe(e.scopes,t.scopes)}:e}function K(e,t){return t?{...e,callbacks:$(e.callbacks,t.callbacks),web_origins:$(e.web_origins,t.web_origins),allowed_logout_urls:$(e.allowed_logout_urls,t.allowed_logout_urls),allowed_origins:$(e.allowed_origins,t.allowed_origins)}:e}function x(e,t){const{controlPlaneTenantId:n,controlPlaneClientId:r}=t;return{...e,multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:r},connections:{...e.connections,get:async(a,s)=>{const o=await e.connections.get(a,s);if(!o||!n||a===n)return o;const i=await e.connections.list(n);return q(o,i.connections||[])},list:async(a,s)=>{const o=await e.connections.list(a,s);if(!n||a===n)return o;const i=await e.connections.list(n),u=o.connections.map(c=>q(c,i.connections||[]));return{...o,connections:u}}},clientConnections:{...e.clientConnections,listByClient:async(a,s)=>{let o=await e.clientConnections.listByClient(a,s);if(o.length===0&&(o=(await e.connections.list(a)).connections||[]),!n||a===n)return o;const i=await e.connections.list(n);return o.map(u=>q(u,i.connections||[]))}},clients:{...e.clients,get:async(a,s)=>{const o=await e.clients.get(a,s);if(!o)return null;if(!n||!r||a===n&&s===r)return o;const i=await e.clients.get(n,r);return K(o,i)},getByClientId:async a=>{const s=await e.clients.getByClientId(a);if(!s)return null;if(!n||!r||s.tenant_id===n&&s.client_id===r)return s;const o=await e.clients.get(n,r);return{...K(s,o),tenant_id:s.tenant_id}}},emailProviders:{...e.emailProviders,get:async a=>{const s=await e.emailProviders.get(a);return s||(!n||a===n?null:e.emailProviders.get(n))}},resourceServers:{...e.resourceServers,get:async(a,s)=>{const o=await e.resourceServers.get(a,s);if(!o||!n||a===n)return o;const u=(await e.resourceServers.list(n,{q:`identifier:${o.identifier}`,per_page:1})).resource_servers[0]??null;return W(o,u)},list:async(a,s)=>{const o=await e.resourceServers.list(a,s);if(!n||a===n)return o;const i=await e.resourceServers.list(n),u=new Map(i.resource_servers.map(l=>[l.identifier,l])),c=o.resource_servers.map(l=>W(l,u.get(l.identifier)??null));return{...o,resource_servers:c}}}}}function k(e,t){return x(e,t)}function ee(e){return async(t,n)=>{const r=t.var.user;return(r==null?void 0:r.tenant_id)===e&&r.org_name&&t.set("tenant_id",r.org_name),n()}}function te(e){return async(t,n)=>{if(!e.accessControl)return n();const{controlPlaneTenantId:r}=e.accessControl,a=t.var.org_name,s=t.var.organization_id,o=a||s;let i=t.var.tenant_id;const u=t.var.user,l=(u!=null&&u.aud?Array.isArray(u.aud)?u.aud:[u.aud]:[]).includes(_.MANAGEMENT_API_AUDIENCE);if(!i&&o&&l&&(t.set("tenant_id",o),i=o),!i)throw new S(400,{message:"Tenant ID not found in request"});if(!V(s,i,r,a))throw new S(403,{message:`Access denied to tenant ${i}`});return n()}}function ne(e){return async(t,n)=>{if(!e.subdomainRouting)return n();const{baseDomain:r,reservedSubdomains:a=[],resolveSubdomain:s}=e.subdomainRouting,o=t.req.header("host")||"";let i=null;if(o.endsWith(r)){const c=o.slice(0,-(r.length+1));c&&!c.includes(".")&&(i=c)}if(i&&a.includes(i)&&(i=null),!i)return e.accessControl&&t.set("tenant_id",e.accessControl.controlPlaneTenantId),n();let u=null;if(s)u=await s(i);else if(e.subdomainRouting.useOrganizations!==!1&&e.accessControl)try{const c=await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId,i);c&&(u=c.id)}catch{}if(!u)throw new S(404,{message:`Tenant not found for subdomain: ${i}`});return t.set("tenant_id",u),n()}}function re(e){return async(t,n)=>{if(!e.databaseIsolation)return n();const r=t.var.tenant_id;if(!r)throw new S(400,{message:"Tenant ID not found in request"});try{const a=await e.databaseIsolation.getAdapters(r);t.env.data=a}catch(a){throw console.error(`Failed to resolve database for tenant ${r}:`,a),new S(500,{message:"Failed to resolve tenant database"})}return n()}}function j(e){const t=ne(e),n=te(e),r=re(e);return async(a,s)=>(await t(a,async()=>{}),await n(a,async()=>{}),await r(a,async()=>{}),s())}function ye(e){const{dataAdapter:t,controlPlane:n,controlPlane:{tenantId:r="control_plane",clientId:a}={},sync:s={resourceServers:!0,roles:!0},defaultPermissions:o=["tenant:admin"],requireOrganizationMatch:i=!1,managementApiExtensions:u=[],entityHooks:c,getChildTenantIds:l,getAdapters:g,...d}=e;let f=t,m=t;n&&(f=k(t,{controlPlaneTenantId:r,controlPlaneClientId:a}),m={...t,multiTenancyConfig:{controlPlaneTenantId:r,controlPlaneClientId:a}});const w=s!==!1,h=w?{resourceServers:s.resourceServers??!0,roles:s.roles??!0}:{resourceServers:!1,roles:!1},T={controlPlaneTenantId:r,getChildTenantIds:l??(async()=>(await _.fetchAll(M=>f.tenants.list(M),"tenants",{cursorField:"id",pageSize:100})).filter(M=>M.id!==r).map(M=>M.id)),getAdapters:g??(async()=>f),getControlPlaneAdapters:async()=>f,sync:h},{entityHooks:C,tenantHooks:P}=Y(T),v={resourceServers:[C.resourceServers,...(c==null?void 0:c.resourceServers)??[]],roles:[C.roles,...(c==null?void 0:c.roles)??[]],connections:(c==null?void 0:c.connections)??[],tenants:(c==null?void 0:c.tenants)??[],rolePermissions:(c==null?void 0:c.rolePermissions)??[]},A=F({accessControl:{controlPlaneTenantId:r,requireOrganizationMatch:i,defaultPermissions:o}},{tenants:P}),{app:b}=_.init({dataAdapter:f,managementDataAdapter:m,...d,entityHooks:v,managementApiExtensions:[...u,{path:"/tenants",router:A}]});return b.use("/api/v2/*",ee(r)),w&&b.use("/api/v2/*",Z()),{app:b,controlPlaneTenantId:r}}function he(e){const t=O(e);return{name:"multi-tenancy",middleware:j(e),hooks:t,routes:[{path:"/management",handler:F(e,t)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),e.accessControl&&console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`),e.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`),e.databaseIsolation&&console.log("  - Database isolation enabled")}}}function O(e){const t=e.accessControl?Q(e.accessControl):{},n=e.databaseIsolation?J(e.databaseIsolation):{},r=X(e);return{...t,...n,tenants:r}}function ae(e){const t=new ce.Hono,n=O(e);return t.route("/tenants",F(e,n)),t}function ve(e){return{hooks:O(e),middleware:j(e),app:ae(e),config:e,wrapAdapters:(t,n)=>{var r;return k(t,{controlPlaneTenantId:(r=e.accessControl)==null?void 0:r.controlPlaneTenantId,controlPlaneClientId:n==null?void 0:n.controlPlaneClientId})}}}exports.createAccessControlHooks=Q;exports.createAccessControlMiddleware=te;exports.createControlPlaneTenantMiddleware=ee;exports.createDatabaseHooks=J;exports.createDatabaseMiddleware=re;exports.createMultiTenancy=ae;exports.createMultiTenancyHooks=O;exports.createMultiTenancyMiddleware=j;exports.createMultiTenancyPlugin=he;exports.createProtectSyncedMiddleware=Z;exports.createProvisioningHooks=X;exports.createRuntimeFallbackAdapter=x;exports.createSubdomainMiddleware=ne;exports.createSyncHooks=Y;exports.createTenantsOpenAPIRouter=F;exports.initMultiTenant=ye;exports.setupMultiTenancy=ve;exports.validateTenantAccess=V;exports.withRuntimeFallback=k;

package/dist/multi-tenancy.mjs

@@ -1,30 +1,30 @@
-var X = Object.defineProperty;
-var Y = (e, t, n) => t in e ? X(e, t, { enumerable: !0, configurable: !0, writable: !0, value: n }) : e[t] = n;
-var O = (e, t, n) => Y(e, typeof t != "symbol" ? t + "" : t, n);
-import { Hono as Z } from "hono";
-import { MANAGEMENT_API_SCOPES as x, MANAGEMENT_API_AUDIENCE as K, fetchAll as R, auth0QuerySchema as ee, tenantSchema as N, tenantInsertSchema as te, connectionSchema as ne, connectionOptionsSchema as re, init as ae } from "authhero";
-import { OpenAPIHono as se, createRoute as D, z as S } from "@hono/zod-openapi";
-function oe(e) {
+var Y = Object.defineProperty;
+var Z = (e, t, n) => t in e ? Y(e, t, { enumerable: !0, configurable: !0, writable: !0, value: n }) : e[t] = n;
+var M = (e, t, n) => Z(e, typeof t != "symbol" ? t + "" : t, n);
+import { Hono as x } from "hono";
+import { MANAGEMENT_API_SCOPES as ee, MANAGEMENT_API_AUDIENCE as Q, fetchAll as z, auth0QuerySchema as te, tenantSchema as N, tenantInsertSchema as ne, connectionSchema as re, connectionOptionsSchema as se, init as ae } from "authhero";
+import { OpenAPIHono as oe, createRoute as O, z as S } from "@hono/zod-openapi";
+function ie(e) {
   const { controlPlaneTenantId: t, requireOrganizationMatch: n = !0 } = e;
   return {
-    async onTenantAccessValidation(r, a) {
-      if (a === t)
+    async onTenantAccessValidation(r, s) {
+      if (s === t)
         return !0;
       if (n) {
-        const s = r.var.org_name, o = r.var.organization_id, i = s || o;
-        return i ? i.toLowerCase() === a.toLowerCase() : !1;
+        const a = r.var.org_name, o = r.var.organization_id, i = a || o;
+        return i ? i.toLowerCase() === s.toLowerCase() : !1;
       }
       return !0;
     }
   };
 }
-function ie(e, t, n, r) {
+function ce(e, t, n, r) {
   if (t === n)
     return !0;
-  const a = r || e;
-  return a ? a.toLowerCase() === t.toLowerCase() : !1;
+  const s = r || e;
+  return s ? s.toLowerCase() === t.toLowerCase() : !1;
 }
-function ce(e) {
+function le(e) {
   return {
     async resolveDataAdapters(t) {
       try {
@@ -39,23 +39,23 @@ function ce(e) {
     }
   };
 }
-function le(e) {
+function ue(e) {
   return `urn:authhero:tenant:${e.toLowerCase()}`;
 }
-function ue(e) {
+function de(e) {
   return {
     async beforeCreate(t, n) {
       return !n.audience && n.id ? {
         ...n,
-        audience: le(n.id)
+        audience: ue(n.id)
       } : n;
     },
     async afterCreate(t, n) {
-      const { accessControl: r, databaseIsolation: a } = e;
-      r && t.ctx && await de(t, n, r), a != null && a.onProvision && await a.onProvision(n.id);
+      const { accessControl: r, databaseIsolation: s } = e;
+      r && t.ctx && await fe(t, n, r), s != null && s.onProvision && await s.onProvision(n.id);
     },
     async beforeDelete(t, n) {
-      const { accessControl: r, databaseIsolation: a } = e;
+      const { accessControl: r, databaseIsolation: s } = e;
       if (r)
         try {
           const o = (await t.adapters.organizations.list(
@@ -65,29 +65,29 @@ function ue(e) {
             r.controlPlaneTenantId,
             o.id
           );
-        } catch (s) {
+        } catch (a) {
           console.warn(
             `Failed to remove organization for tenant ${n}:`,
-            s
+            a
           );
         }
-      if (a != null && a.onDeprovision)
+      if (s != null && s.onDeprovision)
         try {
-          await a.onDeprovision(n);
-        } catch (s) {
+          await s.onDeprovision(n);
+        } catch (a) {
           console.warn(
             `Failed to deprovision database for tenant ${n}:`,
-            s
+            a
           );
         }
     }
   };
 }
-async function de(e, t, n) {
+async function fe(e, t, n) {
   const {
     controlPlaneTenantId: r,
-    defaultPermissions: a,
-    defaultRoles: s,
+    defaultPermissions: s,
+    defaultRoles: a,
     issuer: o,
     adminRoleName: i = "Tenant Admin",
     adminRoleDescription: u = "Full access to all tenant management operations",
@@ -100,14 +100,14 @@ async function de(e, t, n) {
     }
   );
   let g;
-  if (o && (g = await me(
+  if (o && (g = await ge(
     e,
     r,
     i,
     u
   )), c && e.ctx) {
     const d = e.ctx.var.user;
-    if (d != null && d.sub && !await fe(
+    if (d != null && d.sub && !await me(
       e,
       r,
       d.sub
@@ -130,13 +130,13 @@ async function de(e, t, n) {
         );
       }
   }
-  s && s.length > 0 && console.log(
-    `Would assign roles ${s.join(", ")} to organization ${l.id}`
-  ), a && a.length > 0 && console.log(
-    `Would grant permissions ${a.join(", ")} to organization ${l.id}`
+  a && a.length > 0 && console.log(
+    `Would assign roles ${a.join(", ")} to organization ${l.id}`
+  ), s && s.length > 0 && console.log(
+    `Would grant permissions ${s.join(", ")} to organization ${l.id}`
   );
 }
-async function fe(e, t, n) {
+async function me(e, t, n) {
   const r = await e.adapters.userRoles.list(
     t,
     n,
@@ -144,10 +144,10 @@ async function fe(e, t, n) {
     ""
     // Empty string for global roles
   );
-  for (const a of r)
+  for (const s of r)
     if ((await e.adapters.rolePermissions.list(
       t,
-      a.id,
+      s.id,
       { per_page: 1e3 }
     )).some(
       (i) => i.permission_name === "admin:organizations"
@@ -155,14 +155,14 @@ async function fe(e, t, n) {
       return !0;
   return !1;
 }
-async function me(e, t, n, r) {
-  const s = (await e.adapters.roles.list(t, {})).roles.find((c) => c.name === n);
-  if (s)
-    return s.id;
+async function ge(e, t, n, r) {
+  const a = (await e.adapters.roles.list(t, {})).roles.find((c) => c.name === n);
+  if (a)
+    return a.id;
   const o = await e.adapters.roles.create(t, {
     name: n,
     description: r
-  }), i = K, u = x.map((c) => ({
+  }), i = Q, u = ee.map((c) => ({
     role_id: o.id,
     resource_server_identifier: i,
     permission_name: c.value
@@ -174,7 +174,7 @@ async function me(e, t, n, r) {
   ), o.id;
 }
 function H(e, t, n = () => !0) {
-  const { controlPlaneTenantId: r, getChildTenantIds: a, getAdapters: s } = e, o = /* @__PURE__ */ new Map();
+  const { controlPlaneTenantId: r, getChildTenantIds: s, getAdapters: a } = e, o = /* @__PURE__ */ new Map();
   async function i(l, g, d) {
     return (await t(l).list(g, {
       q: `name:${d}`,
@@ -182,11 +182,11 @@ function H(e, t, n = () => !0) {
     }))[0] ?? null;
   }
   async function u(l) {
-    const g = await a(), d = t(await s(r));
+    const g = await s(), d = t(await a(r));
     await Promise.all(
       g.map(async (f) => {
         try {
-          const m = await s(f), w = t(m), p = {
+          const m = await a(f), w = t(m), p = {
             ...d.transform(l),
             is_system: !0
           }, y = await i(m, f, l.name), _ = y ? w.getId(y) : void 0;
@@ -205,11 +205,11 @@ function H(e, t, n = () => !0) {
     );
   }
   async function c(l) {
-    const g = await a();
+    const g = await s();
     await Promise.all(
       g.map(async (d) => {
         try {
-          const f = await s(d), m = t(f), w = await i(f, d, l), h = w ? m.getId(w) : void 0;
+          const f = await a(d), m = t(f), w = await i(f, d, l), h = w ? m.getId(w) : void 0;
           w && h && await m.remove(d, h);
         } catch (f) {
           console.error(
@@ -240,12 +240,12 @@ function H(e, t, n = () => !0) {
   };
 }
 function B(e, t, n = () => !0) {
-  const { controlPlaneTenantId: r, getControlPlaneAdapters: a, getAdapters: s } = e;
+  const { controlPlaneTenantId: r, getControlPlaneAdapters: s, getAdapters: a } = e;
   return {
     async afterCreate(o, i) {
       if (i.id !== r)
         try {
-          const u = await a(), c = await s(i.id), l = t(u), g = t(c), d = await R(
+          const u = await s(), c = await a(i.id), l = t(u), g = t(c), d = await z(
             (f) => l.listPaginated(r, f),
             l.listKey,
             { cursorField: "id", pageSize: 100 }
@@ -312,30 +312,30 @@ function L(e) {
   var t;
   return ((t = e.metadata) == null ? void 0 : t.sync) !== !1;
 }
-function ge(e) {
-  const { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, a = t.roles ?? !0, s = (m) => L(m) ? n.resourceServers ? n.resourceServers(m) : !0 : !1, o = (m) => L(m) ? n.roles ? n.roles(m) : !0 : !1, i = r ? H(
+function we(e) {
+  const { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, s = t.roles ?? !0, a = (m) => L(m) ? n.resourceServers ? n.resourceServers(m) : !0 : !1, o = (m) => L(m) ? n.roles ? n.roles(m) : !0 : !1, i = r ? H(
     e,
     G,
-    s
-  ) : void 0, u = a ? H(
+    a
+  ) : void 0, u = s ? H(
     e,
     U,
     o
   ) : void 0, c = r ? B(
     e,
     G,
-    s
-  ) : void 0, l = a ? B(
+    a
+  ) : void 0, l = s ? B(
     e,
     U,
     o
-  ) : void 0, g = a ? {
+  ) : void 0, g = s ? {
     async afterCreate(m, w) {
       var h;
       if (w.id !== e.controlPlaneTenantId) {
         await ((h = l == null ? void 0 : l.afterCreate) == null ? void 0 : h.call(l, m, w));
         try {
-          const p = await e.getControlPlaneAdapters(), y = await e.getAdapters(w.id), _ = await R(
+          const p = await e.getControlPlaneAdapters(), y = await e.getAdapters(w.id), _ = await z(
             (C) => p.roles.list(
               e.controlPlaneTenantId,
               C
@@ -437,8 +437,8 @@ var b = class extends Error {
    */
   constructor(t = 500, n) {
     super(n == null ? void 0 : n.message, { cause: n == null ? void 0 : n.cause });
-    O(this, "res");
-    O(this, "status");
+    M(this, "res");
+    M(this, "status");
     this.res = n == null ? void 0 : n.res, this.status = t;
   }
   /**
@@ -456,14 +456,14 @@ var b = class extends Error {
   }
 };
 function q(e, t) {
-  const n = new se();
+  const n = new oe();
   return n.openapi(
-    D({
+    O({
       tags: ["tenants"],
       method: "get",
       path: "/",
       request: {
-        query: ee
+        query: te
       },
       security: [
         {
@@ -488,10 +488,10 @@ function q(e, t) {
     }),
     async (r) => {
       var m, w, h, p, y, _;
-      const a = r.req.valid("query"), { page: s, per_page: o, include_totals: i, q: u } = a, c = r.var.user, l = (c == null ? void 0 : c.permissions) || [];
+      const s = r.req.valid("query"), { page: a, per_page: o, include_totals: i, q: u } = s, c = r.var.user, l = (c == null ? void 0 : c.permissions) || [];
       if (l.includes("auth:read") || l.includes("admin:organizations")) {
         const T = await r.env.data.tenants.list({
-          page: s,
+          page: a,
           per_page: o,
           include_totals: i,
           q: u
@@ -505,14 +505,14 @@ function q(e, t) {
       }
       const d = ((h = e.accessControl) == null ? void 0 : h.controlPlaneTenantId) ?? ((p = r.env.data.multiTenancyConfig) == null ? void 0 : p.controlPlaneTenantId);
       if (d && (c != null && c.sub)) {
-        const C = (await R(
-          (z) => r.env.data.userOrganizations.listUserOrganizations(
+        const C = (await z(
+          ($) => r.env.data.userOrganizations.listUserOrganizations(
             d,
             c.sub,
-            z
+            $
           ),
           "organizations"
-        )).map((z) => z.name);
+        )).map(($) => $.name);
         if (C.length === 0)
           return i ? r.json({
             tenants: [],
@@ -520,29 +520,29 @@ function q(e, t) {
             limit: o ?? 50,
             length: 0
           }) : r.json({ tenants: [] });
-        const v = C.length, P = s ?? 0, A = o ?? 50, $ = P * A, I = C.slice($, $ + A);
+        const v = C.length, P = a ?? 0, A = o ?? 50, R = P * A, I = C.slice(R, R + A);
         if (I.length === 0)
           return i ? r.json({
             tenants: [],
-            start: $,
+            start: R,
             limit: A,
             length: v
           }) : r.json({ tenants: [] });
-        const k = I.map((z) => `id:${z}`).join(" OR "), J = u ? `(${k}) AND (${u})` : k, E = await r.env.data.tenants.list({
-          q: J,
+        const k = I.map(($) => `id:${$}`).join(" OR "), X = u ? `(${k}) AND (${u})` : k, E = await r.env.data.tenants.list({
+          q: X,
           per_page: A,
           include_totals: !1
           // We calculate totals from accessibleTenantIds
         });
         return i ? r.json({
           tenants: E.tenants,
-          start: $,
+          start: R,
           limit: A,
           length: v
         }) : r.json({ tenants: E.tenants });
       }
       const f = await r.env.data.tenants.list({
-        page: s,
+        page: a,
         per_page: o,
         include_totals: i,
         q: u
@@ -555,7 +555,7 @@ function q(e, t) {
       }) : r.json({ tenants: f.tenants });
     }
   ), n.openapi(
-    D({
+    O({
       tags: ["tenants"],
       method: "post",
       path: "/",
@@ -563,7 +563,7 @@ function q(e, t) {
         body: {
           content: {
             "application/json": {
-              schema: te
+              schema: ne
             }
           }
         }
@@ -592,22 +592,22 @@ function q(e, t) {
     }),
     async (r) => {
       var u, c;
-      const a = r.var.user;
-      if (!(a != null && a.sub))
+      const s = r.var.user;
+      if (!(s != null && s.sub))
         throw new b(401, {
           message: "Authentication required to create tenants"
         });
-      let s = r.req.valid("json");
+      let a = r.req.valid("json");
       const o = {
         adapters: r.env.data,
         ctx: r
       };
-      (u = t.tenants) != null && u.beforeCreate && (s = await t.tenants.beforeCreate(o, s));
-      const i = await r.env.data.tenants.create(s);
+      (u = t.tenants) != null && u.beforeCreate && (a = await t.tenants.beforeCreate(o, a));
+      const i = await r.env.data.tenants.create(a);
       return (c = t.tenants) != null && c.afterCreate && await t.tenants.afterCreate(o, i), r.json(i, 201);
     }
   ), n.openapi(
-    D({
+    O({
       tags: ["tenants"],
       method: "delete",
       path: "/{id}",
@@ -635,30 +635,30 @@ function q(e, t) {
     }),
     async (r) => {
       var u, c, l, g;
-      const { id: a } = r.req.valid("param"), s = ((u = e.accessControl) == null ? void 0 : u.controlPlaneTenantId) ?? ((c = r.env.data.multiTenancyConfig) == null ? void 0 : c.controlPlaneTenantId);
-      if (s) {
+      const { id: s } = r.req.valid("param"), a = ((u = e.accessControl) == null ? void 0 : u.controlPlaneTenantId) ?? ((c = r.env.data.multiTenancyConfig) == null ? void 0 : c.controlPlaneTenantId);
+      if (a) {
         const d = r.var.user;
         if (!(d != null && d.sub))
           throw new b(401, {
             message: "Authentication required"
           });
-        if (a === s)
+        if (s === a)
           throw new b(403, {
             message: "Cannot delete the control plane"
           });
-        if (!(await R(
+        if (!(await z(
           (w) => r.env.data.userOrganizations.listUserOrganizations(
-            s,
+            a,
             d.sub,
             w
           ),
           "organizations"
-        )).some((w) => w.name === a))
+        )).some((w) => w.name === s))
           throw new b(403, {
             message: "Access denied to this tenant"
           });
       }
-      if (!await r.env.data.tenants.get(a))
+      if (!await r.env.data.tenants.get(s))
         throw new b(404, {
           message: "Tenant not found"
         });
@@ -666,11 +666,11 @@ function q(e, t) {
         adapters: r.env.data,
         ctx: r
       };
-      return (l = t.tenants) != null && l.beforeDelete && await t.tenants.beforeDelete(i, a), await r.env.data.tenants.remove(a), (g = t.tenants) != null && g.afterDelete && await t.tenants.afterDelete(i, a), r.body(null, 204);
+      return (l = t.tenants) != null && l.beforeDelete && await t.tenants.beforeDelete(i, s), await r.env.data.tenants.remove(s), (g = t.tenants) != null && g.afterDelete && await t.tenants.afterDelete(i, s), r.body(null, 204);
     }
   ), n;
 }
-function we(e) {
+function pe(e) {
   const t = [
     {
       pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -680,13 +680,13 @@ function we(e) {
     { pattern: /\/api\/v2\/connections\/([^/]+)$/, type: "connection" }
   ];
   for (const { pattern: n, type: r } of t) {
-    const a = e.match(n);
-    if (a && a[1])
-      return { type: r, id: a[1] };
+    const s = e.match(n);
+    if (s && s[1])
+      return { type: r, id: s[1] };
   }
   return null;
 }
-async function pe(e, t, n) {
+async function ye(e, t, n) {
   try {
     switch (n.type) {
       case "resource_server": {
@@ -708,41 +708,41 @@ async function pe(e, t, n) {
     return !1;
   }
 }
-function ye(e) {
+function he(e) {
   return {
     resource_server: "resource server",
     role: "role",
     connection: "connection"
   }[e];
 }
-function he() {
+function ve() {
   return async (e, t) => {
     if (!["PATCH", "PUT", "DELETE"].includes(e.req.method))
       return t();
-    const n = we(e.req.path);
+    const n = pe(e.req.path);
     if (!n)
       return t();
     const r = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
     if (!r)
       return t();
-    if (await pe(e.env.data, r, n))
+    if (await ye(e.env.data, r, n))
       throw new b(403, {
-        message: `This ${ye(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
+        message: `This ${he(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return t();
   };
 }
-function M(e, t) {
+function D(e, t) {
   const n = t.find(
-    (a) => a.strategy === e.strategy
+    (s) => s.strategy === e.strategy
   );
   if (!(n != null && n.options))
     return e;
-  const r = ne.passthrough().parse({
+  const r = re.passthrough().parse({
     ...n,
     ...e
   });
-  return r.options = re.passthrough().parse({
+  return r.options = se.passthrough().parse({
     ...n.options || {},
     ...e.options
   }), r;
@@ -754,7 +754,28 @@ function F(e, t) {
   ];
   return [...new Set(n)];
 }
+function _e(e, t) {
+  if (!(t != null && t.length))
+    return e || [];
+  if (!(e != null && e.length))
+    return t;
+  const n = /* @__PURE__ */ new Map();
+  for (const r of t)
+    n.set(r.value, r);
+  for (const r of e)
+    n.set(r.value, r);
+  return Array.from(n.values());
+}
 function W(e, t) {
+  return t ? {
+    ...e,
+    scopes: _e(
+      e.scopes,
+      t.scopes
+    )
+  } : e;
+}
+function K(e, t) {
   return t ? {
     ...e,
     callbacks: F(e.callbacks, t.callbacks),
@@ -772,7 +793,7 @@ function W(e, t) {
     )
   } : e;
 }
-function ve(e, t) {
+function Te(e, t) {
   const { controlPlaneTenantId: n, controlPlaneClientId: r } = t;
   return {
     ...e,
@@ -783,25 +804,25 @@ function ve(e, t) {
     },
     connections: {
       ...e.connections,
-      get: async (a, s) => {
+      get: async (s, a) => {
         const o = await e.connections.get(
-          a,
-          s
+          s,
+          a
         );
-        if (!o || !n || a === n)
+        if (!o || !n || s === n)
           return o;
         const i = await e.connections.list(n);
-        return M(
+        return D(
           o,
           i.connections || []
         );
       },
-      list: async (a, s) => {
-        const o = await e.connections.list(a, s);
-        if (!n || a === n)
+      list: async (s, a) => {
+        const o = await e.connections.list(s, a);
+        if (!n || s === n)
           return o;
         const i = await e.connections.list(n), u = o.connections.map(
-          (c) => M(
+          (c) => D(
             c,
             i.connections || []
           )
@@ -814,16 +835,16 @@ function ve(e, t) {
     },
     clientConnections: {
       ...e.clientConnections,
-      listByClient: async (a, s) => {
+      listByClient: async (s, a) => {
         let o = await e.clientConnections.listByClient(
-          a,
-          s
+          s,
+          a
         );
-        if (o.length === 0 && (o = (await e.connections.list(a)).connections || []), !n || a === n)
+        if (o.length === 0 && (o = (await e.connections.list(s)).connections || []), !n || s === n)
           return o;
         const i = await e.connections.list(n);
         return o.map(
-          (u) => M(
+          (u) => D(
             u,
             i.connections || []
           )
@@ -832,39 +853,77 @@ function ve(e, t) {
     },
     clients: {
       ...e.clients,
-      get: async (a, s) => {
-        const o = await e.clients.get(a, s);
+      get: async (s, a) => {
+        const o = await e.clients.get(s, a);
         if (!o)
           return null;
-        if (!n || !r || a === n && s === r)
+        if (!n || !r || s === n && a === r)
           return o;
         const i = await e.clients.get(
           n,
           r
         );
-        return W(o, i);
+        return K(o, i);
       },
-      getByClientId: async (a) => {
-        const s = await e.clients.getByClientId(a);
-        if (!s)
+      getByClientId: async (s) => {
+        const a = await e.clients.getByClientId(s);
+        if (!a)
           return null;
-        if (!n || !r || s.tenant_id === n && s.client_id === r)
-          return s;
+        if (!n || !r || a.tenant_id === n && a.client_id === r)
+          return a;
         const o = await e.clients.get(
           n,
           r
         );
         return {
-          ...W(s, o),
-          tenant_id: s.tenant_id
+          ...K(a, o),
+          tenant_id: a.tenant_id
         };
       }
     },
     emailProviders: {
       ...e.emailProviders,
-      get: async (a) => {
-        const s = await e.emailProviders.get(a);
-        return s || (!n || a === n ? null : e.emailProviders.get(n));
+      get: async (s) => {
+        const a = await e.emailProviders.get(s);
+        return a || (!n || s === n ? null : e.emailProviders.get(n));
+      }
+    },
+    resourceServers: {
+      ...e.resourceServers,
+      get: async (s, a) => {
+        const o = await e.resourceServers.get(
+          s,
+          a
+        );
+        if (!o || !n || s === n)
+          return o;
+        const u = (await e.resourceServers.list(
+          n,
+          { q: `identifier:${o.identifier}`, per_page: 1 }
+        )).resource_servers[0] ?? null;
+        return W(
+          o,
+          u
+        );
+      },
+      list: async (s, a) => {
+        const o = await e.resourceServers.list(s, a);
+        if (!n || s === n)
+          return o;
+        const i = await e.resourceServers.list(
+          n
+        ), u = new Map(
+          i.resource_servers.map((l) => [l.identifier, l])
+        ), c = o.resource_servers.map(
+          (l) => W(
+            l,
+            u.get(l.identifier) ?? null
+          )
+        );
+        return {
+          ...o,
+          resource_servers: c
+        };
       }
     }
     // Note: Additional adapters can be extended here for runtime fallback:
@@ -872,31 +931,31 @@ function ve(e, t) {
     // - branding: Fall back to control plane branding/themes
   };
 }
-function Q(e, t) {
-  return ve(e, t);
+function V(e, t) {
+  return Te(e, t);
 }
-function _e(e) {
+function Ce(e) {
   return async (t, n) => {
     const r = t.var.user;
     return (r == null ? void 0 : r.tenant_id) === e && r.org_name && t.set("tenant_id", r.org_name), n();
   };
 }
-function Te(e) {
+function Pe(e) {
   return async (t, n) => {
     if (!e.accessControl)
       return n();
-    const { controlPlaneTenantId: r } = e.accessControl, a = t.var.org_name, s = t.var.organization_id, o = a || s;
+    const { controlPlaneTenantId: r } = e.accessControl, s = t.var.org_name, a = t.var.organization_id, o = s || a;
     let i = t.var.tenant_id;
-    const u = t.var.user, l = (u != null && u.aud ? Array.isArray(u.aud) ? u.aud : [u.aud] : []).includes(K);
+    const u = t.var.user, l = (u != null && u.aud ? Array.isArray(u.aud) ? u.aud : [u.aud] : []).includes(Q);
     if (!i && o && l && (t.set("tenant_id", o), i = o), !i)
       throw new b(400, {
         message: "Tenant ID not found in request"
       });
-    if (!ie(
-      s,
+    if (!ce(
+      a,
       i,
       r,
-      a
+      s
     ))
       throw new b(403, {
         message: `Access denied to tenant ${i}`
@@ -904,25 +963,25 @@ function Te(e) {
     return n();
   };
 }
-function Ce(e) {
+function Ae(e) {
   return async (t, n) => {
     if (!e.subdomainRouting)
       return n();
     const {
       baseDomain: r,
-      reservedSubdomains: a = [],
-      resolveSubdomain: s
+      reservedSubdomains: s = [],
+      resolveSubdomain: a
     } = e.subdomainRouting, o = t.req.header("host") || "";
     let i = null;
     if (o.endsWith(r)) {
       const c = o.slice(0, -(r.length + 1));
       c && !c.includes(".") && (i = c);
     }
-    if (i && a.includes(i) && (i = null), !i)
+    if (i && s.includes(i) && (i = null), !i)
       return e.accessControl && t.set("tenant_id", e.accessControl.controlPlaneTenantId), n();
     let u = null;
-    if (s)
-      u = await s(i);
+    if (a)
+      u = await a(i);
     else if (e.subdomainRouting.useOrganizations !== !1 && e.accessControl)
       try {
         const c = await t.env.data.organizations.get(
@@ -939,7 +998,7 @@ function Ce(e) {
     return t.set("tenant_id", u), n();
   };
 }
-function Pe(e) {
+function be(e) {
   return async (t, n) => {
     if (!e.databaseIsolation)
       return n();
@@ -949,12 +1008,12 @@ function Pe(e) {
         message: "Tenant ID not found in request"
       });
     try {
-      const a = await e.databaseIsolation.getAdapters(r);
-      t.env.data = a;
-    } catch (a) {
+      const s = await e.databaseIsolation.getAdapters(r);
+      t.env.data = s;
+    } catch (s) {
       throw console.error(
         `Failed to resolve database for tenant ${r}:`,
-        a
+        s
       ), new b(500, {
         message: "Failed to resolve tenant database"
       });
@@ -962,22 +1021,22 @@ function Pe(e) {
     return n();
   };
 }
-function V(e) {
-  const t = Ce(e), n = Te(e), r = Pe(e);
-  return async (a, s) => (await t(a, async () => {
-  }), await n(a, async () => {
-  }), await r(a, async () => {
-  }), s());
+function J(e) {
+  const t = Ae(e), n = Pe(e), r = be(e);
+  return async (s, a) => (await t(s, async () => {
+  }), await n(s, async () => {
+  }), await r(s, async () => {
+  }), a());
 }
-function ze(e) {
+function Fe(e) {
   const {
     dataAdapter: t,
     controlPlane: n,
     controlPlane: {
       tenantId: r = "control_plane",
-      clientId: a
+      clientId: s
     } = {},
-    sync: s = { resourceServers: !0, roles: !0 },
+    sync: a = { resourceServers: !0, roles: !0 },
     defaultPermissions: o = ["tenant:admin"],
     requireOrganizationMatch: i = !1,
     managementApiExtensions: u = [],
@@ -987,22 +1046,22 @@ function ze(e) {
     ...d
   } = e;
   let f = t, m = t;
-  n && (f = Q(t, {
+  n && (f = V(t, {
     controlPlaneTenantId: r,
-    controlPlaneClientId: a
+    controlPlaneClientId: s
   }), m = {
     ...t,
     multiTenancyConfig: {
       controlPlaneTenantId: r,
-      controlPlaneClientId: a
+      controlPlaneClientId: s
     }
   });
-  const w = s !== !1, h = w ? {
-    resourceServers: s.resourceServers ?? !0,
-    roles: s.roles ?? !0
+  const w = a !== !1, h = w ? {
+    resourceServers: a.resourceServers ?? !0,
+    roles: a.roles ?? !0
   } : { resourceServers: !1, roles: !1 }, _ = {
     controlPlaneTenantId: r,
-    getChildTenantIds: l ?? (async () => (await R(
+    getChildTenantIds: l ?? (async () => (await z(
       (I) => f.tenants.list(I),
       "tenants",
       { cursorField: "id", pageSize: 100 }
@@ -1010,7 +1069,7 @@ function ze(e) {
     getAdapters: g ?? (async () => f),
     getControlPlaneAdapters: async () => f,
     sync: h
-  }, { entityHooks: T, tenantHooks: C } = ge(_), v = {
+  }, { entityHooks: T, tenantHooks: C } = we(_), v = {
     resourceServers: [
       T.resourceServers,
       ...(c == null ? void 0 : c.resourceServers) ?? []
@@ -1038,14 +1097,14 @@ function ze(e) {
       { path: "/tenants", router: P }
     ]
   });
-  return A.use("/api/v2/*", _e(r)), w && A.use("/api/v2/*", he()), { app: A, controlPlaneTenantId: r };
+  return A.use("/api/v2/*", Ce(r)), w && A.use("/api/v2/*", ve()), { app: A, controlPlaneTenantId: r };
 }
-function Re(e) {
+function Me(e) {
   const t = j(e);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
-    middleware: V(e),
+    middleware: J(e),
     // Provide lifecycle hooks
     hooks: t,
     // Mount tenant management routes
@@ -1066,22 +1125,22 @@ function Re(e) {
   };
 }
 function j(e) {
-  const t = e.accessControl ? oe(e.accessControl) : {}, n = e.databaseIsolation ? ce(e.databaseIsolation) : {}, r = ue(e);
+  const t = e.accessControl ? ie(e.accessControl) : {}, n = e.databaseIsolation ? le(e.databaseIsolation) : {}, r = de(e);
   return {
     ...t,
     ...n,
     tenants: r
   };
 }
-function Ae(e) {
-  const t = new Z(), n = j(e);
+function Ie(e) {
+  const t = new x(), n = j(e);
   return t.route("/tenants", q(e, n)), t;
 }
-function Fe(e) {
+function Oe(e) {
   return {
     hooks: j(e),
-    middleware: V(e),
-    app: Ae(e),
+    middleware: J(e),
+    app: Ie(e),
     config: e,
     /**
      * Wraps data adapters with runtime fallback from the control plane.
@@ -1093,7 +1152,7 @@ function Fe(e) {
      */
     wrapAdapters: (t, n) => {
       var r;
-      return Q(t, {
+      return V(t, {
         controlPlaneTenantId: (r = e.accessControl) == null ? void 0 : r.controlPlaneTenantId,
         controlPlaneClientId: n == null ? void 0 : n.controlPlaneClientId
       });
@@ -1101,23 +1160,23 @@ function Fe(e) {
   };
 }
 export {
-  oe as createAccessControlHooks,
-  Te as createAccessControlMiddleware,
-  _e as createControlPlaneTenantMiddleware,
-  ce as createDatabaseHooks,
-  Pe as createDatabaseMiddleware,
-  Ae as createMultiTenancy,
+  ie as createAccessControlHooks,
+  Pe as createAccessControlMiddleware,
+  Ce as createControlPlaneTenantMiddleware,
+  le as createDatabaseHooks,
+  be as createDatabaseMiddleware,
+  Ie as createMultiTenancy,
   j as createMultiTenancyHooks,
-  V as createMultiTenancyMiddleware,
-  Re as createMultiTenancyPlugin,
-  he as createProtectSyncedMiddleware,
-  ue as createProvisioningHooks,
-  ve as createRuntimeFallbackAdapter,
-  Ce as createSubdomainMiddleware,
-  ge as createSyncHooks,
+  J as createMultiTenancyMiddleware,
+  Me as createMultiTenancyPlugin,
+  ve as createProtectSyncedMiddleware,
+  de as createProvisioningHooks,
+  Te as createRuntimeFallbackAdapter,
+  Ae as createSubdomainMiddleware,
+  we as createSyncHooks,
   q as createTenantsOpenAPIRouter,
-  ze as initMultiTenant,
-  Fe as setupMultiTenancy,
-  ie as validateTenantAccess,
-  Q as withRuntimeFallback
+  Fe as initMultiTenant,
+  Oe as setupMultiTenancy,
+  ce as validateTenantAccess,
+  V as withRuntimeFallback
 };

package/dist/types/hooks/resource-server-sync.d.ts

@@ -27,6 +27,8 @@ export interface ResourceServerSyncConfig {
     /**
      * Optional: Transform the resource server before syncing to child tenants.
      * Useful for modifying identifiers or removing sensitive data.
+     * Note: Scopes are never synced - they are inherited at runtime via the
+     * settings-inheritance middleware.
      */
     transformForSync?: (resourceServer: ResourceServer, targetTenantId: string) => ResourceServerInsert;
 }
@@ -106,6 +108,8 @@ export interface TenantResourceServerSyncConfig {
     /**
      * Optional: Transform the resource server before syncing to the new tenant.
      * Useful for modifying identifiers or removing sensitive data.
+     * Note: Scopes are never synced - they are inherited at runtime via the
+     * settings-inheritance middleware.
      */
     transformForSync?: (resourceServer: ResourceServer, targetTenantId: string) => ResourceServerInsert;
 }

package/dist/types/hooks/resource-server-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-server-sync.d.ts","sourceRoot":"","sources":["../../../src/hooks/resource-server-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,cAAc,EACd,oBAAoB,EAErB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,iBAAiB,EAAqB,MAAM,UAAU,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3C;;;OAGG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzD;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,KAAK,OAAO,CAAC;IAEzD;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CACjB,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,MAAM,KACnB,oBAAoB,CAAC;CAC3B;AAED;;GAEG;AACH,UAAU,iBAAiB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,WAAW,CAAC,EAAE,CACZ,GAAG,EAAE,iBAAiB,EACtB,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,WAAW,CAAC,EAAE,CACZ,GAAG,EAAE,iBAAiB,EACtB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,wBAAwB,GAC/B,yBAAyB,CA2L3B;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,uBAAuB,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;IAErD;;;OAGG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzD;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,KAAK,OAAO,CAAC;IAEzD;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CACjB,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,MAAM,KACnB,oBAAoB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,8BAA8B,GACrC,iBAAiB,CAiFnB"}
+{"version":3,"file":"resource-server-sync.d.ts","sourceRoot":"","sources":["../../../src/hooks/resource-server-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,cAAc,EACd,oBAAoB,EAErB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,iBAAiB,EAAqB,MAAM,UAAU,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3C;;;OAGG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzD;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,KAAK,OAAO,CAAC;IAEzD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CACjB,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,MAAM,KACnB,oBAAoB,CAAC;CAC3B;AAED;;GAEG;AACH,UAAU,iBAAiB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,WAAW,CAAC,EAAE,CACZ,GAAG,EAAE,iBAAiB,EACtB,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,WAAW,CAAC,EAAE,CACZ,GAAG,EAAE,iBAAiB,EACtB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,wBAAwB,GAC/B,yBAAyB,CA6L3B;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,uBAAuB,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;IAErD;;;OAGG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzD;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,KAAK,OAAO,CAAC;IAEzD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CACjB,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,MAAM,KACnB,oBAAoB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,8BAA8B,GACrC,iBAAiB,CAoFnB"}

package/dist/types/middleware/settings-inheritance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAKb,MAAM,UAAU,CAAC;AA8ElB;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAgMd;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}
+{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAOb,MAAM,UAAU,CAAC;AA8HlB;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAmQd;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "14.10.0",
+  "version": "14.11.0",
   "description": "Multi-tenancy support for AuthHero with organization-based access control and per-tenant database isolation",
   "files": [
     "dist"
@@ -36,9 +36,9 @@
     "typescript": "^5.6.0",
     "vite": "^6.0.0",
     "vitest": "^2.1.0",
-    "authhero": "4.29.0",
-    "@authhero/adapter-interfaces": "0.130.0",
-    "@authhero/kysely-adapter": "10.93.0"
+    "@authhero/kysely-adapter": "10.95.0",
+    "authhero": "4.35.0",
+    "@authhero/adapter-interfaces": "0.132.0"
   },
   "dependencies": {
     "zod": "^3.24.0"