@authhero/multi-tenancy 14.20.0 → 14.20.1

package/dist/multi-tenancy.cjs

@@ -1 +1 @@
-"use strict";var ce=Object.defineProperty;var le=(e,t,n)=>t in e?ce(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n;var k=(e,t,n)=>le(e,typeof t!="symbol"?t+"":t,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const ue=require("hono"),_=require("authhero"),T=require("@hono/zod-openapi");function J(e){const{controlPlaneTenantId:t,requireOrganizationMatch:n=!0}=e;return{async onTenantAccessValidation(r,a){if(a===t)return!0;if(n){const s=r.var.org_name,c=r.var.organization_id,i=s||c;return i?i.toLowerCase()===a.toLowerCase():!1}return!0}}}function X(e,t,n,r){if(t===n)return!0;const a=r||e;return a?a.toLowerCase()===t.toLowerCase():!1}function Y(e){return{async resolveDataAdapters(t){try{return await e.getAdapters(t)}catch(n){console.error(`Failed to resolve data adapters for tenant ${t}:`,n);return}}}}function de(e){return`urn:authhero:tenant:${e.toLowerCase()}`}function N(e){return{async beforeCreate(t,n){return!n.audience&&n.id?{...n,audience:de(n.id)}:n},async afterCreate(t,n){const{accessControl:r,databaseIsolation:a}=e;r&&t.ctx&&await fe(t,n,r),a!=null&&a.onProvision&&await a.onProvision(n.id)},async beforeDelete(t,n){const{accessControl:r,databaseIsolation:a}=e;if(r)try{const c=(await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find(i=>i.name===n);c&&await t.adapters.organizations.remove(r.controlPlaneTenantId,c.id)}catch(s){console.warn(`Failed to remove organization for tenant ${n}:`,s)}if(a!=null&&a.onDeprovision)try{await a.onDeprovision(n)}catch(s){console.warn(`Failed to deprovision database for tenant ${n}:`,s)}}}}async function fe(e,t,n){const{controlPlaneTenantId:r,defaultPermissions:a,defaultRoles:s,issuer:c,adminRoleName:i="Tenant Admin",adminRoleDescription:u="Full access to all tenant management operations",addCreatorToOrganization:o=!0}=n,l=await e.adapters.organizations.create(r,{name:t.id,display_name:t.friendly_name||t.id});let g;if(c&&(g=await ge(e,r,i,u)),o&&e.ctx){const d=e.ctx.var.user;if(d!=null&&d.sub&&!await me(e,r,d.sub))try{await e.adapters.userOrganizations.create(r,{user_id:d.sub,organization_id:l.id}),g&&await e.adapters.userRoles.create(r,d.sub,g,l.id)}catch(m){console.warn(`Failed to add creator ${d.sub} to organization ${l.id}:`,m)}}s&&s.length>0&&console.log(`Would assign roles ${s.join(", ")} to organization ${l.id}`),a&&a.length>0&&console.log(`Would grant permissions ${a.join(", ")} to organization ${l.id}`)}async function me(e,t,n){const r=await e.adapters.userRoles.list(t,n,void 0,"");for(const a of r)if((await e.adapters.rolePermissions.list(t,a.id,{per_page:1e3})).some(i=>i.permission_name==="admin:organizations"))return!0;return!1}async function ge(e,t,n,r){const s=(await e.adapters.roles.list(t,{})).roles.find(o=>o.name===n);if(s)return s.id;const c=await e.adapters.roles.create(t,{name:n,description:r}),i=_.MANAGEMENT_API_AUDIENCE,u=_.MANAGEMENT_API_SCOPES.map(o=>({role_id:c.id,resource_server_identifier:i,permission_name:o.value}));return await e.adapters.rolePermissions.assign(t,c.id,u),c.id}function U(e,t,n=()=>!0){const{controlPlaneTenantId:r,getChildTenantIds:a,getAdapters:s}=e,c=new Map;async function i(l,g,d){return(await t(l).list(g,{q:`name:${d}`,per_page:1}))[0]??null}async function u(l){const g=await a(),d=t(await s(r));await Promise.all(g.map(async f=>{try{const m=await s(f),w=t(m),y={...d.transform(l),is_system:!0},C=await i(m,f,l.name),P=C?w.getId(C):void 0;if(C&&P){const S=w.preserveOnUpdate?w.preserveOnUpdate(C,y):y;await w.update(f,P,S)}else await w.create(f,y)}catch(m){console.error(`Failed to sync ${d.listKey} "${l.name}" to tenant "${f}":`,m)}}))}async function o(l){const g=await a();await Promise.all(g.map(async d=>{try{const f=await s(d),m=t(f),w=await i(f,d,l),b=w?m.getId(w):void 0;w&&b&&await m.remove(d,b)}catch(f){console.error(`Failed to delete entity "${l}" from tenant "${d}":`,f)}}))}return{afterCreate:async(l,g)=>{l.tenantId===r&&n(g)&&await u(g)},afterUpdate:async(l,g,d)=>{l.tenantId===r&&n(d)&&await u(d)},beforeDelete:async(l,g)=>{if(l.tenantId!==r)return;const f=await t(l.adapters).get(l.tenantId,g);f&&n(f)&&c.set(g,f)},afterDelete:async(l,g)=>{if(l.tenantId!==r)return;const d=c.get(g);d&&(c.delete(g),await o(d.name))}}}function G(e,t,n=()=>!0){const{controlPlaneTenantId:r,getControlPlaneAdapters:a,getAdapters:s}=e;return{async afterCreate(c,i){if(i.id!==r)try{const u=await a(),o=await s(i.id),l=t(u),g=t(o),d=await _.fetchAll(f=>l.listPaginated(r,f),l.listKey,{cursorField:"id",pageSize:100});await Promise.all(d.filter(f=>n(f)).map(async f=>{try{const m=l.transform(f);await g.create(i.id,{...m,is_system:!0})}catch(m){console.error(`Failed to sync entity to new tenant "${i.id}":`,m)}}))}catch(u){console.error(`Failed to sync entities to new tenant "${i.id}":`,u)}}}}const L=e=>({list:async(t,n)=>(await e.resourceServers.list(t,n)).resource_servers,listPaginated:(t,n)=>e.resourceServers.list(t,n),get:(t,n)=>e.resourceServers.get(t,n),create:(t,n)=>e.resourceServers.create(t,n),update:(t,n,r)=>e.resourceServers.update(t,n,r),remove:(t,n)=>e.resourceServers.remove(t,n),listKey:"resource_servers",getId:t=>t.id,transform:t=>({id:t.id,name:t.name,identifier:t.identifier,scopes:t.scopes,signing_alg:t.signing_alg,token_lifetime:t.token_lifetime,token_lifetime_for_web:t.token_lifetime_for_web})}),W=e=>({list:async(t,n)=>(await e.roles.list(t,n)).roles,listPaginated:(t,n)=>e.roles.list(t,n),get:(t,n)=>e.roles.get(t,n),create:(t,n)=>e.roles.create(t,n),update:(t,n,r)=>e.roles.update(t,n,r),remove:(t,n)=>e.roles.remove(t,n),listKey:"roles",getId:t=>t.id,transform:t=>({id:t.id,name:t.name,description:t.description})});function K(e){var t;return((t=e.metadata)==null?void 0:t.sync)!==!1}function Z(e){const{sync:t={},filters:n={}}=e,r=t.resourceServers??!0,a=t.roles??!0,s=m=>K(m)?n.resourceServers?n.resourceServers(m):!0:!1,c=m=>K(m)?n.roles?n.roles(m):!0:!1,i=r?U(e,L,s):void 0,u=a?U(e,W,c):void 0,o=r?G(e,L,s):void 0,l=a?G(e,W,c):void 0,g=a?{async afterCreate(m,w){var b;if(w.id!==e.controlPlaneTenantId){await((b=l==null?void 0:l.afterCreate)==null?void 0:b.call(l,m,w));try{const y=await e.getControlPlaneAdapters(),C=await e.getAdapters(w.id),P=await _.fetchAll(p=>y.roles.list(e.controlPlaneTenantId,p),"roles",{cursorField:"id",pageSize:100}),S=new Map;for(const p of P.filter(A=>{var h;return((h=n.roles)==null?void 0:h.call(n,A))??!0})){const A=await d(C,w.id,p.name);A&&S.set(p.name,A.id)}for(const p of P.filter(A=>{var h;return((h=n.roles)==null?void 0:h.call(n,A))??!0})){const A=S.get(p.name);if(A)try{const h=await y.rolePermissions.list(e.controlPlaneTenantId,p.id,{});h.length>0&&await C.rolePermissions.assign(w.id,A,h.map(R=>({role_id:A,resource_server_identifier:R.resource_server_identifier,permission_name:R.permission_name})))}catch(h){console.error(`Failed to sync permissions for role "${p.name}" to tenant "${w.id}":`,h)}}}catch(y){console.error(`Failed to sync role permissions to tenant "${w.id}":`,y)}}}}:void 0;async function d(m,w,b){return(await m.roles.list(w,{q:`name:${b}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:i,roles:u},tenantHooks:{async afterCreate(m,w){const b=[o==null?void 0:o.afterCreate,(g==null?void 0:g.afterCreate)??(l==null?void 0:l.afterCreate)],y=[];for(const C of b)if(C)try{await C(m,w)}catch(P){y.push(P instanceof Error?P:new Error(String(P)))}if(y.length===1)throw y[0];if(y.length>1)throw new AggregateError(y,y.map(C=>C.message).join("; "))}}}}var I=class extends Error{constructor(t=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});k(this,"res");k(this,"status");this.res=n==null?void 0:n.res,this.status=t}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function q(e,t){const n=new T.OpenAPIHono;return n.openapi(T.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:_.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:T.z.object({tenants:T.z.array(_.tenantSchema),start:T.z.number().optional(),limit:T.z.number().optional(),length:T.z.number().optional()})}},description:"List of tenants"}}}),async r=>{var m,w,b,y,C,P;const a=r.req.valid("query"),{page:s,per_page:c,include_totals:i,q:u}=a,o=r.var.user,l=(o==null?void 0:o.permissions)||[];if(l.includes("auth:read")||l.includes("admin:organizations")){const S=await r.env.data.tenants.list({page:s,per_page:c,include_totals:i,q:u});return i?r.json({tenants:S.tenants,start:((m=S.totals)==null?void 0:m.start)??0,limit:((w=S.totals)==null?void 0:w.limit)??c,length:S.tenants.length}):r.json({tenants:S.tenants})}const d=((b=e.accessControl)==null?void 0:b.controlPlaneTenantId)??((y=r.env.data.multiTenancyConfig)==null?void 0:y.controlPlaneTenantId);if(d&&(o!=null&&o.sub)){const p=(await _.fetchAll(M=>r.env.data.userOrganizations.listUserOrganizations(d,o.sub,M),"organizations")).map(M=>M.name);if(p.length===0)return i?r.json({tenants:[],start:0,limit:c??50,length:0}):r.json({tenants:[]});const A=p.length,h=s??0,R=c??50,F=h*R,D=p.slice(F,F+R);if(D.length===0)return i?r.json({tenants:[],start:F,limit:R,length:A}):r.json({tenants:[]});const z=D.map(M=>`id:${M}`).join(" OR "),v=u?`(${z}) AND (${u})`:z,$=await r.env.data.tenants.list({q:v,per_page:R,include_totals:!1});return i?r.json({tenants:$.tenants,start:F,limit:R,length:A}):r.json({tenants:$.tenants})}const f=await r.env.data.tenants.list({page:s,per_page:c,include_totals:i,q:u});return i?r.json({tenants:f.tenants,start:((C=f.totals)==null?void 0:C.start)??0,limit:((P=f.totals)==null?void 0:P.limit)??c,length:f.tenants.length}):r.json({tenants:f.tenants})}),n.openapi(T.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:_.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:_.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async r=>{var u,o;const a=r.var.user;if(!(a!=null&&a.sub))throw new I(401,{message:"Authentication required to create tenants"});let s=r.req.valid("json");const c={adapters:r.env.data,ctx:r};(u=t.tenants)!=null&&u.beforeCreate&&(s=await t.tenants.beforeCreate(c,s));const i=await r.env.data.tenants.create(s);return(o=t.tenants)!=null&&o.afterCreate&&await t.tenants.afterCreate(c,i),r.json(i,201)}),n.openapi(T.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:T.z.object({id:T.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async r=>{var u,o,l,g;const{id:a}=r.req.valid("param"),s=((u=e.accessControl)==null?void 0:u.controlPlaneTenantId)??((o=r.env.data.multiTenancyConfig)==null?void 0:o.controlPlaneTenantId);if(s){const d=r.var.user;if(!(d!=null&&d.sub))throw new I(401,{message:"Authentication required"});if(a===s)throw new I(403,{message:"Cannot delete the control plane"});if(!(await _.fetchAll(w=>r.env.data.userOrganizations.listUserOrganizations(s,d.sub,w),"organizations")).some(w=>w.name===a))throw new I(403,{message:"Access denied to this tenant"})}if(!await r.env.data.tenants.get(a))throw new I(404,{message:"Tenant not found"});const i={adapters:r.env.data,ctx:r};return(l=t.tenants)!=null&&l.beforeDelete&&await t.tenants.beforeDelete(i,a),await r.env.data.tenants.remove(a),(g=t.tenants)!=null&&g.afterDelete&&await t.tenants.afterDelete(i,a),r.body(null,204)}),n.openapi(T.createRoute({tags:["tenants","settings"],method:"get",path:"/settings",request:{headers:T.z.object({"tenant-id":T.z.string().optional()})},security:[{Bearer:["read:tenants","auth:read"]}],responses:{200:{content:{"application/json":{schema:_.tenantSchema}},description:"Current tenant settings"}}}),async r=>{const a=await r.env.data.tenants.get(r.var.tenant_id);if(!a)throw new I(404,{message:"Tenant not found"});return r.json(a)}),n.openapi(T.createRoute({tags:["tenants","settings"],method:"patch",path:"/settings",request:{headers:T.z.object({"tenant-id":T.z.string().optional()}),body:{content:{"application/json":{schema:T.z.object(_.tenantInsertSchema.shape).partial()}}}},security:[{Bearer:["update:tenants","auth:write"]}],responses:{200:{content:{"application/json":{schema:_.tenantSchema}},description:"Updated tenant settings"}}}),async r=>{const a=r.req.valid("json"),{id:s,...c}=a,i=await r.env.data.tenants.get(r.var.tenant_id);if(!i)throw new I(404,{message:"Tenant not found"});const u=_.deepMergePatch(i,c);await r.env.data.tenants.update(r.var.tenant_id,u);const o=await r.env.data.tenants.get(r.var.tenant_id);if(!o)throw new I(500,{message:"Failed to retrieve updated tenant"});return r.json(o)}),n}function we(e){const t=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:r}of t){const a=e.match(n);if(a&&a[1])return{type:r,id:a[1]}}return null}async function pe(e,t,n){try{switch(n.type){case"resource_server":{const r=await e.resourceServers.get(t,n.id);return(r==null?void 0:r.is_system)===!0}case"role":{const r=await e.roles.get(t,n.id);return(r==null?void 0:r.is_system)===!0}case"connection":{const r=await e.connections.get(t,n.id);return(r==null?void 0:r.is_system)===!0}default:return!1}}catch{return!1}}function he(e){return{resource_server:"resource server",role:"role",connection:"connection"}[e]}function x(){return async(e,t)=>{if(!["PATCH","PUT","DELETE"].includes(e.req.method))return t();const n=we(e.req.path);if(!n)return t();const r=e.var.tenant_id||e.req.header("x-tenant-id")||e.req.header("tenant-id");if(!r)return t();if(await pe(e.env.data,r,n))throw new I(403,{message:`This ${he(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return t()}}function E(e,t){const n=t.find(a=>a.strategy===e.strategy);if(!(n!=null&&n.options))return e;const r=_.connectionSchema.passthrough().parse({...n,...e});return r.options=_.connectionOptionsSchema.passthrough().parse({...n.options||{},...e.options}),r}function j(e,t){const n=[...t||[],...e||[]];return[...new Set(n)]}function ye(e,t){if(!(t!=null&&t.length))return e||[];if(!(e!=null&&e.length))return t;const n=new Map;for(const r of t)n.set(r.value,r);for(const r of e)n.set(r.value,r);return Array.from(n.values())}function Q(e,t){return t?{...e,scopes:ye(e.scopes,t.scopes)}:e}function V(e,t){return t?{...e,callbacks:j(e.callbacks,t.callbacks),web_origins:j(e.web_origins,t.web_origins),allowed_logout_urls:j(e.allowed_logout_urls,t.allowed_logout_urls),allowed_origins:j(e.allowed_origins,t.allowed_origins)}:e}function ee(e,t){return{...e.resourceServers,get:async(n,r)=>{const a=await e.resourceServers.get(n,r);if(!a||!t||n===t||!a.is_system)return a;const s=await e.resourceServers.get(t,r);return Q(a,s)},list:async(n,r)=>{const a=await e.resourceServers.list(n,r);if(!t||n===t)return a;const s=t,c=a.resource_servers.filter(o=>!!(o.is_system&&o.id)).map(o=>o.id);if(c.length===0)return a;const i=new Map;await Promise.all(c.map(async o=>{const l=await e.resourceServers.get(s,o);l&&i.set(o,l)}));const u=a.resource_servers.map(o=>o.is_system&&o.id?Q(o,i.get(o.id)??null):o);return{...a,resource_servers:u}}}}function te(e,t){return{...e,resourceServers:ee(e,t.controlPlaneTenantId)}}function ne(e,t){const{controlPlaneTenantId:n,controlPlaneClientId:r}=t;return{...e,multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:r},connections:{...e.connections,get:async(a,s)=>{const c=await e.connections.get(a,s);if(!c||!n||a===n)return c;const i=await e.connections.list(n);return E(c,i.connections||[])},list:async(a,s)=>{const c=await e.connections.list(a,s);if(!n||a===n)return c;const i=await e.connections.list(n),u=c.connections.map(o=>E(o,i.connections||[]));return{...c,connections:u}}},clientConnections:{...e.clientConnections,listByClient:async(a,s)=>{let c=await e.clientConnections.listByClient(a,s);if(c.length===0&&(c=(await e.connections.list(a)).connections||[]),!n||a===n)return c;const i=await e.connections.list(n);return c.map(u=>E(u,i.connections||[]))}},clients:{...e.clients,get:async(a,s)=>{const c=await e.clients.get(a,s);if(!c)return null;if(!n||!r||a===n&&s===r)return c;const i=await e.clients.get(n,r);return V(c,i)},getByClientId:async a=>{const s=await e.clients.getByClientId(a);if(!s)return null;if(!n||!r||s.tenant_id===n&&s.client_id===r)return s;const c=await e.clients.get(n,r);return{...V(s,c),tenant_id:s.tenant_id}}},emailProviders:{...e.emailProviders,get:async a=>{const s=await e.emailProviders.get(a);return s||(!n||a===n?null:e.emailProviders.get(n))}},resourceServers:ee(e,n)}}function B(e,t){return ne(e,t)}function re(e){return async(t,n)=>{const r=t.var.user;return(r==null?void 0:r.tenant_id)===e&&r.org_name&&t.set("tenant_id",r.org_name),n()}}function ae(e){return async(t,n)=>{if(!e.accessControl)return n();const{controlPlaneTenantId:r}=e.accessControl,a=t.var.org_name,s=t.var.organization_id,c=a||s;let i=t.var.tenant_id;const u=t.var.user,l=(u!=null&&u.aud?Array.isArray(u.aud)?u.aud:[u.aud]:[]).includes(_.MANAGEMENT_API_AUDIENCE);if(!i&&c&&l&&(t.set("tenant_id",c),i=c),!i)throw new I(400,{message:"Tenant ID not found in request"});if(!X(s,i,r,a))throw new I(403,{message:`Access denied to tenant ${i}`});return n()}}function se(e){return async(t,n)=>{if(!e.subdomainRouting)return n();const{baseDomain:r,reservedSubdomains:a=[],resolveSubdomain:s}=e.subdomainRouting,c=t.req.header("x-forwarded-host")||t.req.header("host")||"";let i=null;if(c.endsWith(r)){const o=c.slice(0,-(r.length+1));o&&!o.includes(".")&&(i=o)}if(i&&a.includes(i)&&(i=null),!i)return e.accessControl&&t.set("tenant_id",e.accessControl.controlPlaneTenantId),n();let u=null;if(s)u=await s(i);else if(e.subdomainRouting.useOrganizations!==!1&&e.accessControl)try{const o=await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId,i);o&&(u=o.id)}catch{}if(!u)throw new I(404,{message:`Tenant not found for subdomain: ${i}`});return t.set("tenant_id",u),n()}}function oe(e){return async(t,n)=>{if(!e.databaseIsolation)return n();const r=t.var.tenant_id;if(!r)throw new I(400,{message:"Tenant ID not found in request"});try{const a=await e.databaseIsolation.getAdapters(r);t.env.data=a}catch(a){throw console.error(`Failed to resolve database for tenant ${r}:`,a),new I(500,{message:"Failed to resolve tenant database"})}return n()}}function H(e){const t=se(e),n=ae(e),r=oe(e);return async(a,s)=>(await t(a,async()=>{}),await n(a,async()=>{}),await r(a,async()=>{}),s())}function ve(e){const{dataAdapter:t,controlPlane:n,controlPlane:{tenantId:r="control_plane",clientId:a}={},sync:s={resourceServers:!0,roles:!0},defaultPermissions:c=["tenant:admin"],requireOrganizationMatch:i=!1,managementApiExtensions:u=[],entityHooks:o,getChildTenantIds:l,getAdapters:g,...d}=e;let f=t,m=t;n&&(f=B(t,{controlPlaneTenantId:r,controlPlaneClientId:a}),m={...te(t,{controlPlaneTenantId:r}),multiTenancyConfig:{controlPlaneTenantId:r,controlPlaneClientId:a}});const w=s!==!1,b=w?{resourceServers:s.resourceServers??!0,roles:s.roles??!0}:{resourceServers:!1,roles:!1},P={controlPlaneTenantId:r,getChildTenantIds:l??(async()=>(await _.fetchAll(v=>f.tenants.list(v),"tenants",{cursorField:"id",pageSize:100})).filter(v=>v.id!==r).map(v=>v.id)),getAdapters:g??(async()=>f),getControlPlaneAdapters:async()=>f,sync:b},{entityHooks:S,tenantHooks:p}=Z(P),A={resourceServers:[S.resourceServers,...(o==null?void 0:o.resourceServers)??[]],roles:[S.roles,...(o==null?void 0:o.roles)??[]],connections:(o==null?void 0:o.connections)??[],tenants:(o==null?void 0:o.tenants)??[],rolePermissions:(o==null?void 0:o.rolePermissions)??[]},h=N({accessControl:{controlPlaneTenantId:r,requireOrganizationMatch:i,defaultPermissions:c}}),F=q({accessControl:{controlPlaneTenantId:r,requireOrganizationMatch:i,defaultPermissions:c}},{tenants:{async beforeCreate(z,v){return h.beforeCreate&&(v=await h.beforeCreate(z,v)),p.beforeCreate&&(v=await p.beforeCreate(z,v)),v},async afterCreate(z,v){var $,M;await(($=h.afterCreate)==null?void 0:$.call(h,z,v)),await((M=p.afterCreate)==null?void 0:M.call(p,z,v))},async beforeDelete(z,v){var $,M;await(($=h.beforeDelete)==null?void 0:$.call(h,z,v)),await((M=p.beforeDelete)==null?void 0:M.call(p,z,v))}}}),{app:D}=_.init({dataAdapter:f,managementDataAdapter:m,...d,entityHooks:A,managementApiExtensions:[...u,{path:"/tenants",router:F}]});return D.use("/api/v2/*",re(r)),w&&D.use("/api/v2/*",x()),{app:D,controlPlaneTenantId:r}}function _e(e){const t=O(e);return{name:"multi-tenancy",middleware:H(e),hooks:t,routes:[{path:"/management",handler:q(e,t)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),e.accessControl&&console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`),e.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`),e.databaseIsolation&&console.log("  - Database isolation enabled")}}}function O(e){const t=e.accessControl?J(e.accessControl):{},n=e.databaseIsolation?Y(e.databaseIsolation):{},r=N(e);return{...t,...n,tenants:r}}function ie(e){const t=new ue.Hono,n=O(e);return t.route("/tenants",q(e,n)),t}function Te(e){return{hooks:O(e),middleware:H(e),app:ie(e),config:e,wrapAdapters:(t,n)=>{var r;return B(t,{controlPlaneTenantId:(r=e.accessControl)==null?void 0:r.controlPlaneTenantId,controlPlaneClientId:n==null?void 0:n.controlPlaneClientId})}}}exports.createAccessControlHooks=J;exports.createAccessControlMiddleware=ae;exports.createControlPlaneTenantMiddleware=re;exports.createDatabaseHooks=Y;exports.createDatabaseMiddleware=oe;exports.createMultiTenancy=ie;exports.createMultiTenancyHooks=O;exports.createMultiTenancyMiddleware=H;exports.createMultiTenancyPlugin=_e;exports.createProtectSyncedMiddleware=x;exports.createProvisioningHooks=N;exports.createRuntimeFallbackAdapter=ne;exports.createSubdomainMiddleware=se;exports.createSyncHooks=Z;exports.createTenantsOpenAPIRouter=q;exports.initMultiTenant=ve;exports.setupMultiTenancy=Te;exports.validateTenantAccess=X;exports.withRuntimeFallback=B;exports.withSystemResourceServerInheritance=te;
+"use strict";var le=Object.defineProperty;var ue=(e,t,n)=>t in e?le(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n;var O=(e,t,n)=>ue(e,typeof t!="symbol"?t+"":t,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const de=require("hono"),_=require("authhero"),C=require("@hono/zod-openapi");function X(e){const{controlPlaneTenantId:t,requireOrganizationMatch:n=!0}=e;return{async onTenantAccessValidation(r,a){if(a===t)return!0;if(n){const s=r.var.org_name,i=r.var.organization_id,c=s||i;return c?c.toLowerCase()===a.toLowerCase():!1}return!0}}}function Y(e,t,n,r){if(t===n)return!0;const a=r||e;return a?a.toLowerCase()===t.toLowerCase():!1}function Z(e){return{async resolveDataAdapters(t){try{return await e.getAdapters(t)}catch(n){console.error(`Failed to resolve data adapters for tenant ${t}:`,n);return}}}}function fe(e){return`urn:authhero:tenant:${e.toLowerCase()}`}function N(e){return{async beforeCreate(t,n){return!n.audience&&n.id?{...n,audience:fe(n.id)}:n},async afterCreate(t,n){const{accessControl:r,databaseIsolation:a}=e;r&&t.ctx&&await me(t,n,r),a!=null&&a.onProvision&&await a.onProvision(n.id)},async beforeDelete(t,n){const{accessControl:r,databaseIsolation:a}=e;if(r)try{const i=(await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find(c=>c.name===n);i&&await t.adapters.organizations.remove(r.controlPlaneTenantId,i.id)}catch(s){console.warn(`Failed to remove organization for tenant ${n}:`,s)}if(a!=null&&a.onDeprovision)try{await a.onDeprovision(n)}catch(s){console.warn(`Failed to deprovision database for tenant ${n}:`,s)}}}}async function me(e,t,n){const{controlPlaneTenantId:r,defaultPermissions:a,defaultRoles:s,issuer:i,adminRoleName:c="Tenant Admin",adminRoleDescription:u="Full access to all tenant management operations",addCreatorToOrganization:o=!0}=n,l=await e.adapters.organizations.create(r,{name:t.id,display_name:t.friendly_name||t.id});let g;if(i&&(g=await we(e,r,c,u)),o&&e.ctx){const d=e.ctx.var.user;if(d!=null&&d.sub&&!await ge(e,r,d.sub))try{await e.adapters.userOrganizations.create(r,{user_id:d.sub,organization_id:l.id}),g&&await e.adapters.userRoles.create(r,d.sub,g,l.id)}catch(m){console.warn(`Failed to add creator ${d.sub} to organization ${l.id}:`,m)}}s&&s.length>0&&console.log(`Would assign roles ${s.join(", ")} to organization ${l.id}`),a&&a.length>0&&console.log(`Would grant permissions ${a.join(", ")} to organization ${l.id}`)}async function ge(e,t,n){const r=await e.adapters.userRoles.list(t,n,void 0,"");for(const a of r)if((await e.adapters.rolePermissions.list(t,a.id,{per_page:1e3})).some(c=>c.permission_name==="admin:organizations"))return!0;return!1}async function we(e,t,n,r){const s=(await e.adapters.roles.list(t,{})).roles.find(o=>o.name===n);if(s)return s.id;const i=await e.adapters.roles.create(t,{name:n,description:r}),c=_.MANAGEMENT_API_AUDIENCE,u=_.MANAGEMENT_API_SCOPES.map(o=>({role_id:i.id,resource_server_identifier:c,permission_name:o.value}));return await e.adapters.rolePermissions.assign(t,i.id,u),i.id}function U(e,t,n=()=>!0){const{controlPlaneTenantId:r,getChildTenantIds:a,getAdapters:s}=e,i=new Map;async function c(l,g,d){return(await t(l).list(g,{q:`name:${d}`,per_page:1}))[0]??null}async function u(l){const g=await a(),d=t(await s(r));await Promise.all(g.map(async f=>{try{const m=await s(f),w=t(m),y={...d.transform(l),is_system:!0},T=await c(m,f,l.name),A=T?w.getId(T):void 0;if(T&&A){const S=w.preserveOnUpdate?w.preserveOnUpdate(T,y):y;await w.update(f,A,S)}else await w.create(f,y)}catch(m){console.error(`Failed to sync ${d.listKey} "${l.name}" to tenant "${f}":`,m)}}))}async function o(l){const g=await a();await Promise.all(g.map(async d=>{try{const f=await s(d),m=t(f),w=await c(f,d,l),b=w?m.getId(w):void 0;w&&b&&await m.remove(d,b)}catch(f){console.error(`Failed to delete entity "${l}" from tenant "${d}":`,f)}}))}return{afterCreate:async(l,g)=>{l.tenantId===r&&n(g)&&await u(g)},afterUpdate:async(l,g,d)=>{l.tenantId===r&&n(d)&&await u(d)},beforeDelete:async(l,g)=>{if(l.tenantId!==r)return;const f=await t(l.adapters).get(l.tenantId,g);f&&n(f)&&i.set(g,f)},afterDelete:async(l,g)=>{if(l.tenantId!==r)return;const d=i.get(g);d&&(i.delete(g),await o(d.name))}}}function G(e,t,n=()=>!0){const{controlPlaneTenantId:r,getControlPlaneAdapters:a,getAdapters:s}=e;return{async afterCreate(i,c){if(c.id!==r)try{const u=await a(),o=await s(c.id),l=t(u),g=t(o),d=await _.fetchAll(f=>l.listPaginated(r,f),l.listKey,{cursorField:"id",pageSize:100});await Promise.all(d.filter(f=>n(f)).map(async f=>{try{const m=l.transform(f);await g.create(c.id,{...m,is_system:!0})}catch(m){console.error(`Failed to sync entity to new tenant "${c.id}":`,m)}}))}catch(u){console.error(`Failed to sync entities to new tenant "${c.id}":`,u)}}}}const W=e=>({list:async(t,n)=>(await e.resourceServers.list(t,n)).resource_servers,listPaginated:(t,n)=>e.resourceServers.list(t,n),get:(t,n)=>e.resourceServers.get(t,n),create:(t,n)=>e.resourceServers.create(t,n),update:(t,n,r)=>e.resourceServers.update(t,n,r),remove:(t,n)=>e.resourceServers.remove(t,n),listKey:"resource_servers",getId:t=>t.id,transform:t=>({id:t.id,name:t.name,identifier:t.identifier,scopes:t.scopes,signing_alg:t.signing_alg,token_lifetime:t.token_lifetime,token_lifetime_for_web:t.token_lifetime_for_web})}),L=e=>({list:async(t,n)=>(await e.roles.list(t,n)).roles,listPaginated:(t,n)=>e.roles.list(t,n),get:(t,n)=>e.roles.get(t,n),create:(t,n)=>e.roles.create(t,n),update:(t,n,r)=>e.roles.update(t,n,r),remove:(t,n)=>e.roles.remove(t,n),listKey:"roles",getId:t=>t.id,transform:t=>({id:t.id,name:t.name,description:t.description})});function K(e){var t;return((t=e.metadata)==null?void 0:t.sync)!==!1}function x(e){const{sync:t={},filters:n={}}=e,r=t.resourceServers??!0,a=t.roles??!0,s=m=>K(m)?n.resourceServers?n.resourceServers(m):!0:!1,i=m=>K(m)?n.roles?n.roles(m):!0:!1,c=r?U(e,W,s):void 0,u=a?U(e,L,i):void 0,o=r?G(e,W,s):void 0,l=a?G(e,L,i):void 0,g=a?{async afterCreate(m,w){var b;if(w.id!==e.controlPlaneTenantId){await((b=l==null?void 0:l.afterCreate)==null?void 0:b.call(l,m,w));try{const y=await e.getControlPlaneAdapters(),T=await e.getAdapters(w.id),A=await _.fetchAll(h=>y.roles.list(e.controlPlaneTenantId,h),"roles",{cursorField:"id",pageSize:100}),S=new Map;for(const h of A.filter(P=>{var p;return((p=n.roles)==null?void 0:p.call(n,P))??!0})){const P=await d(T,w.id,h.name);P&&S.set(h.name,P.id)}for(const h of A.filter(P=>{var p;return((p=n.roles)==null?void 0:p.call(n,P))??!0})){const P=S.get(h.name);if(P)try{const p=await y.rolePermissions.list(e.controlPlaneTenantId,h.id,{});p.length>0&&await T.rolePermissions.assign(w.id,P,p.map(R=>({role_id:P,resource_server_identifier:R.resource_server_identifier,permission_name:R.permission_name})))}catch(p){console.error(`Failed to sync permissions for role "${h.name}" to tenant "${w.id}":`,p)}}}catch(y){console.error(`Failed to sync role permissions to tenant "${w.id}":`,y)}}}}:void 0;async function d(m,w,b){return(await m.roles.list(w,{q:`name:${b}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:c,roles:u},tenantHooks:{async afterCreate(m,w){const b=[o==null?void 0:o.afterCreate,(g==null?void 0:g.afterCreate)??(l==null?void 0:l.afterCreate)],y=[];for(const T of b)if(T)try{await T(m,w)}catch(A){y.push(A instanceof Error?A:new Error(String(A)))}if(y.length===1)throw y[0];if(y.length>1)throw new AggregateError(y,y.map(T=>T.message).join("; "))}}}}var I=class extends Error{constructor(t=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});O(this,"res");O(this,"status");this.res=n==null?void 0:n.res,this.status=t}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function D(e,t){const n=new C.OpenAPIHono;return n.openapi(C.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:_.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:C.z.object({tenants:C.z.array(_.tenantSchema),start:C.z.number().optional(),limit:C.z.number().optional(),length:C.z.number().optional()})}},description:"List of tenants"}}}),async r=>{var m,w,b,y,T,A;const a=r.req.valid("query"),{page:s,per_page:i,include_totals:c,q:u}=a,o=r.var.user,l=(o==null?void 0:o.permissions)||[];if(l.includes("auth:read")||l.includes("admin:organizations")){const S=await r.env.data.tenants.list({page:s,per_page:i,include_totals:c,q:u});return c?r.json({tenants:S.tenants,start:((m=S.totals)==null?void 0:m.start)??0,limit:((w=S.totals)==null?void 0:w.limit)??i,length:S.tenants.length}):r.json({tenants:S.tenants})}const d=((b=e.accessControl)==null?void 0:b.controlPlaneTenantId)??((y=r.env.data.multiTenancyConfig)==null?void 0:y.controlPlaneTenantId);if(d&&(o!=null&&o.sub)){const h=(await _.fetchAll(M=>r.env.data.userOrganizations.listUserOrganizations(d,o.sub,M),"organizations")).map(M=>M.name);if(h.length===0)return c?r.json({tenants:[],start:0,limit:i??50,length:0}):r.json({tenants:[]});const P=h.length,p=s??0,R=i??50,$=p*R,j=h.slice($,$+R);if(j.length===0)return c?r.json({tenants:[],start:$,limit:R,length:P}):r.json({tenants:[]});const z=j.map(M=>`id:${M}`).join(" OR "),v=u?`(${z}) AND (${u})`:z,k=await r.env.data.tenants.list({q:v,per_page:R,include_totals:!1});return c?r.json({tenants:k.tenants,start:$,limit:R,length:P}):r.json({tenants:k.tenants})}const f=await r.env.data.tenants.list({page:s,per_page:i,include_totals:c,q:u});return c?r.json({tenants:f.tenants,start:((T=f.totals)==null?void 0:T.start)??0,limit:((A=f.totals)==null?void 0:A.limit)??i,length:f.tenants.length}):r.json({tenants:f.tenants})}),n.openapi(C.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:_.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:_.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async r=>{var u,o;const a=r.var.user;if(!(a!=null&&a.sub))throw new I(401,{message:"Authentication required to create tenants"});let s=r.req.valid("json");const i={adapters:r.env.data,ctx:r};(u=t.tenants)!=null&&u.beforeCreate&&(s=await t.tenants.beforeCreate(i,s));const c=await r.env.data.tenants.create(s);return(o=t.tenants)!=null&&o.afterCreate&&await t.tenants.afterCreate(i,c),r.json(c,201)}),n.openapi(C.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:C.z.object({id:C.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async r=>{var u,o,l,g;const{id:a}=r.req.valid("param"),s=((u=e.accessControl)==null?void 0:u.controlPlaneTenantId)??((o=r.env.data.multiTenancyConfig)==null?void 0:o.controlPlaneTenantId);if(s){const d=r.var.user;if(!(d!=null&&d.sub))throw new I(401,{message:"Authentication required"});if(a===s)throw new I(403,{message:"Cannot delete the control plane"});if(!(await _.fetchAll(w=>r.env.data.userOrganizations.listUserOrganizations(s,d.sub,w),"organizations")).some(w=>w.name===a))throw new I(403,{message:"Access denied to this tenant"})}if(!await r.env.data.tenants.get(a))throw new I(404,{message:"Tenant not found"});const c={adapters:r.env.data,ctx:r};return(l=t.tenants)!=null&&l.beforeDelete&&await t.tenants.beforeDelete(c,a),await r.env.data.tenants.remove(a),(g=t.tenants)!=null&&g.afterDelete&&await t.tenants.afterDelete(c,a),r.body(null,204)}),n.openapi(C.createRoute({tags:["tenants","settings"],method:"get",path:"/settings",request:{headers:C.z.object({"tenant-id":C.z.string().optional()})},security:[{Bearer:["read:tenants","auth:read"]}],responses:{200:{content:{"application/json":{schema:_.tenantSchema}},description:"Current tenant settings"}}}),async r=>{const a=await r.env.data.tenants.get(r.var.tenant_id);if(!a)throw new I(404,{message:"Tenant not found"});return r.json(a)}),n.openapi(C.createRoute({tags:["tenants","settings"],method:"patch",path:"/settings",request:{headers:C.z.object({"tenant-id":C.z.string().optional()}),body:{content:{"application/json":{schema:C.z.object(_.tenantInsertSchema.shape).partial()}}}},security:[{Bearer:["update:tenants","auth:write"]}],responses:{200:{content:{"application/json":{schema:_.tenantSchema}},description:"Updated tenant settings"}}}),async r=>{const a=r.req.valid("json"),{id:s,...i}=a,c=await r.env.data.tenants.get(r.var.tenant_id);if(!c)throw new I(404,{message:"Tenant not found"});const u=_.deepMergePatch(c,i);await r.env.data.tenants.update(r.var.tenant_id,u);const o=await r.env.data.tenants.get(r.var.tenant_id);if(!o)throw new I(500,{message:"Failed to retrieve updated tenant"});return r.json(o)}),n}function he(e){const t=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:r}of t){const a=e.match(n);if(a&&a[1])return{type:r,id:a[1]}}return null}async function pe(e,t,n){try{switch(n.type){case"resource_server":{const r=await e.resourceServers.get(t,n.id);return(r==null?void 0:r.is_system)===!0}case"role":{const r=await e.roles.get(t,n.id);return(r==null?void 0:r.is_system)===!0}case"connection":{const r=await e.connections.get(t,n.id);return(r==null?void 0:r.is_system)===!0}default:return!1}}catch{return!1}}function ye(e){return{resource_server:"resource server",role:"role",connection:"connection"}[e]}function ee(){return async(e,t)=>{if(!["PATCH","PUT","DELETE"].includes(e.req.method))return t();const n=he(e.req.path);if(!n)return t();const r=e.var.tenant_id||e.req.header("x-tenant-id")||e.req.header("tenant-id");if(!r)return t();if(await pe(e.env.data,r,n))throw new I(403,{message:`This ${ye(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return t()}}function E(e,t){const n=t.find(a=>a.strategy===e.strategy);if(!(n!=null&&n.options))return e;const r=_.connectionSchema.passthrough().parse({...n,...e});return r.options=_.connectionOptionsSchema.passthrough().parse({...n.options||{},...e.options}),r}function F(e,t){const n=[...t||[],...e||[]];return[...new Set(n)]}function ve(e,t){if(!(t!=null&&t.length))return e||[];if(!(e!=null&&e.length))return t;const n=new Map;for(const r of t)n.set(r.value,r);for(const r of e)n.set(r.value,r);return Array.from(n.values())}function Q(e,t){return t?{...e,scopes:ve(e.scopes,t.scopes)}:e}function V(e,t){return t?{...e,callbacks:F(e.callbacks,t.callbacks),web_origins:F(e.web_origins,t.web_origins),allowed_logout_urls:F(e.allowed_logout_urls,t.allowed_logout_urls),allowed_origins:F(e.allowed_origins,t.allowed_origins)}:e}function te(e,t){return{...e.resourceServers,get:async(n,r)=>{const a=await e.resourceServers.get(n,r);if(!a||!t||n===t||!a.is_system)return a;const s=await e.resourceServers.get(t,r);return Q(a,s)},list:async(n,r)=>{const a=await e.resourceServers.list(n,r);if(!t||n===t)return a;const s=t,i=a.resource_servers.filter(o=>!!(o.is_system&&o.id)).map(o=>o.id);if(i.length===0)return a;const c=new Map;await Promise.all(i.map(async o=>{const l=await e.resourceServers.get(s,o);l&&c.set(o,l)}));const u=a.resource_servers.map(o=>o.is_system&&o.id?Q(o,c.get(o.id)??null):o);return{...a,resource_servers:u}}}}function ne(e,t){return{...e,resourceServers:te(e,t.controlPlaneTenantId)}}function re(e,t){const{controlPlaneTenantId:n,controlPlaneClientId:r}=t;return{...e,multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:r},connections:{...e.connections,get:async(a,s)=>{const i=await e.connections.get(a,s);if(!i||!n||a===n)return i;const c=await e.connections.list(n);return E(i,c.connections||[])},list:async(a,s)=>{const i=await e.connections.list(a,s);if(!n||a===n)return i;const c=await e.connections.list(n),u=i.connections.map(o=>E(o,c.connections||[]));return{...i,connections:u}}},clientConnections:{...e.clientConnections,listByClient:async(a,s)=>{let i=await e.clientConnections.listByClient(a,s);if(i.length===0&&(i=(await e.connections.list(a)).connections||[]),!n||a===n)return i;const c=await e.connections.list(n);return i.map(u=>E(u,c.connections||[]))}},clients:{...e.clients,get:async(a,s)=>{const i=await e.clients.get(a,s);if(!i)return null;if(!n||!r||a===n&&s===r)return i;const c=await e.clients.get(n,r);return V(i,c)},getByClientId:async a=>{const s=await e.clients.getByClientId(a);if(!s)return null;if(!n||!r||s.tenant_id===n&&s.client_id===r)return s;const i=await e.clients.get(n,r);return{...V(s,i),tenant_id:s.tenant_id}}},emailProviders:{...e.emailProviders,get:async a=>{const s=await e.emailProviders.get(a);return s||(!n||a===n?null:e.emailProviders.get(n))}},resourceServers:te(e,n),hooks:_e(e,n)}}function J(e){if(!e||typeof e!="object")return!1;const t=e.metadata;return!t||typeof t!="object"?!1:t.inheritable===!0}function _e(e,t){return{...e.hooks,list:async(n,r)=>{const a=await e.hooks.list(n,r);if(!t||n===t)return a;const i=((await e.hooks.list(t,r)).hooks||[]).filter(J);if(i.length===0)return a;const c=new Set((a.hooks||[]).map(o=>o.hook_id)),u=i.filter(o=>!c.has(o.hook_id));return{...a,hooks:[...a.hooks||[],...u],length:typeof a.length=="number"?a.length+u.length:a.length}},get:async(n,r)=>{const a=await e.hooks.get(n,r);if(a||!t||n===t)return a;const s=await e.hooks.get(t,r);return s&&J(s)?s:null}}}function H(e,t){return re(e,t)}function ae(e){return async(t,n)=>{const r=t.var.user;return(r==null?void 0:r.tenant_id)===e&&r.org_name&&t.set("tenant_id",r.org_name),n()}}function se(e){return async(t,n)=>{if(!e.accessControl)return n();const{controlPlaneTenantId:r}=e.accessControl,a=t.var.org_name,s=t.var.organization_id,i=a||s;let c=t.var.tenant_id;const u=t.var.user,l=(u!=null&&u.aud?Array.isArray(u.aud)?u.aud:[u.aud]:[]).includes(_.MANAGEMENT_API_AUDIENCE);if(!c&&i&&l&&(t.set("tenant_id",i),c=i),!c)throw new I(400,{message:"Tenant ID not found in request"});if(!Y(s,c,r,a))throw new I(403,{message:`Access denied to tenant ${c}`});return n()}}function oe(e){return async(t,n)=>{if(!e.subdomainRouting)return n();const{baseDomain:r,reservedSubdomains:a=[],resolveSubdomain:s}=e.subdomainRouting,i=t.req.header("x-forwarded-host")||t.req.header("host")||"";let c=null;if(i.endsWith(r)){const o=i.slice(0,-(r.length+1));o&&!o.includes(".")&&(c=o)}if(c&&a.includes(c)&&(c=null),!c)return e.accessControl&&t.set("tenant_id",e.accessControl.controlPlaneTenantId),n();let u=null;if(s)u=await s(c);else if(e.subdomainRouting.useOrganizations!==!1&&e.accessControl)try{const o=await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId,c);o&&(u=o.id)}catch{}if(!u)throw new I(404,{message:`Tenant not found for subdomain: ${c}`});return t.set("tenant_id",u),n()}}function ie(e){return async(t,n)=>{if(!e.databaseIsolation)return n();const r=t.var.tenant_id;if(!r)throw new I(400,{message:"Tenant ID not found in request"});try{const a=await e.databaseIsolation.getAdapters(r);t.env.data=a}catch(a){throw console.error(`Failed to resolve database for tenant ${r}:`,a),new I(500,{message:"Failed to resolve tenant database"})}return n()}}function B(e){const t=oe(e),n=se(e),r=ie(e);return async(a,s)=>(await t(a,async()=>{}),await n(a,async()=>{}),await r(a,async()=>{}),s())}function Ce(e){const{dataAdapter:t,controlPlane:n,controlPlane:{tenantId:r="control_plane",clientId:a}={},sync:s={resourceServers:!0,roles:!0},defaultPermissions:i=["tenant:admin"],requireOrganizationMatch:c=!1,managementApiExtensions:u=[],entityHooks:o,getChildTenantIds:l,getAdapters:g,...d}=e;let f=t,m=t;n&&(f=H(t,{controlPlaneTenantId:r,controlPlaneClientId:a}),m={...ne(t,{controlPlaneTenantId:r}),multiTenancyConfig:{controlPlaneTenantId:r,controlPlaneClientId:a}});const w=s!==!1,b=w?{resourceServers:s.resourceServers??!0,roles:s.roles??!0}:{resourceServers:!1,roles:!1},A={controlPlaneTenantId:r,getChildTenantIds:l??(async()=>(await _.fetchAll(v=>f.tenants.list(v),"tenants",{cursorField:"id",pageSize:100})).filter(v=>v.id!==r).map(v=>v.id)),getAdapters:g??(async()=>f),getControlPlaneAdapters:async()=>f,sync:b},{entityHooks:S,tenantHooks:h}=x(A),P={resourceServers:[S.resourceServers,...(o==null?void 0:o.resourceServers)??[]],roles:[S.roles,...(o==null?void 0:o.roles)??[]],connections:(o==null?void 0:o.connections)??[],tenants:(o==null?void 0:o.tenants)??[],rolePermissions:(o==null?void 0:o.rolePermissions)??[]},p=N({accessControl:{controlPlaneTenantId:r,requireOrganizationMatch:c,defaultPermissions:i}}),$=D({accessControl:{controlPlaneTenantId:r,requireOrganizationMatch:c,defaultPermissions:i}},{tenants:{async beforeCreate(z,v){return p.beforeCreate&&(v=await p.beforeCreate(z,v)),h.beforeCreate&&(v=await h.beforeCreate(z,v)),v},async afterCreate(z,v){var k,M;await((k=p.afterCreate)==null?void 0:k.call(p,z,v)),await((M=h.afterCreate)==null?void 0:M.call(h,z,v))},async beforeDelete(z,v){var k,M;await((k=p.beforeDelete)==null?void 0:k.call(p,z,v)),await((M=h.beforeDelete)==null?void 0:M.call(h,z,v))}}}),{app:j}=_.init({dataAdapter:f,managementDataAdapter:m,...d,entityHooks:P,managementApiExtensions:[...u,{path:"/tenants",router:$}]});return j.use("/api/v2/*",ae(r)),w&&j.use("/api/v2/*",ee()),{app:j,controlPlaneTenantId:r}}function Te(e){const t=q(e);return{name:"multi-tenancy",middleware:B(e),hooks:t,routes:[{path:"/management",handler:D(e,t)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),e.accessControl&&console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`),e.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`),e.databaseIsolation&&console.log("  - Database isolation enabled")}}}function q(e){const t=e.accessControl?X(e.accessControl):{},n=e.databaseIsolation?Z(e.databaseIsolation):{},r=N(e);return{...t,...n,tenants:r}}function ce(e){const t=new de.Hono,n=q(e);return t.route("/tenants",D(e,n)),t}function be(e){return{hooks:q(e),middleware:B(e),app:ce(e),config:e,wrapAdapters:(t,n)=>{var r;return H(t,{controlPlaneTenantId:(r=e.accessControl)==null?void 0:r.controlPlaneTenantId,controlPlaneClientId:n==null?void 0:n.controlPlaneClientId})}}}exports.createAccessControlHooks=X;exports.createAccessControlMiddleware=se;exports.createControlPlaneTenantMiddleware=ae;exports.createDatabaseHooks=Z;exports.createDatabaseMiddleware=ie;exports.createMultiTenancy=ce;exports.createMultiTenancyHooks=q;exports.createMultiTenancyMiddleware=B;exports.createMultiTenancyPlugin=Te;exports.createProtectSyncedMiddleware=ee;exports.createProvisioningHooks=N;exports.createRuntimeFallbackAdapter=re;exports.createSubdomainMiddleware=oe;exports.createSyncHooks=x;exports.createTenantsOpenAPIRouter=D;exports.initMultiTenant=Ce;exports.setupMultiTenancy=be;exports.validateTenantAccess=Y;exports.withRuntimeFallback=H;exports.withSystemResourceServerInheritance=ne;

package/dist/multi-tenancy.mjs

@@ -1,30 +1,30 @@
-var ee = Object.defineProperty;
-var te = (e, t, n) => t in e ? ee(e, t, { enumerable: !0, configurable: !0, writable: !0, value: n }) : e[t] = n;
-var E = (e, t, n) => te(e, typeof t != "symbol" ? t + "" : t, n);
-import { Hono as ne } from "hono";
-import { MANAGEMENT_API_SCOPES as re, MANAGEMENT_API_AUDIENCE as J, fetchAll as D, auth0QuerySchema as ae, tenantSchema as q, tenantInsertSchema as U, deepMergePatch as se, connectionSchema as oe, connectionOptionsSchema as ie, init as ce } from "authhero";
-import { OpenAPIHono as le, createRoute as M, z as I } from "@hono/zod-openapi";
-function ue(e) {
+var te = Object.defineProperty;
+var ne = (e, t, n) => t in e ? te(e, t, { enumerable: !0, configurable: !0, writable: !0, value: n }) : e[t] = n;
+var O = (e, t, n) => ne(e, typeof t != "symbol" ? t + "" : t, n);
+import { Hono as re } from "hono";
+import { MANAGEMENT_API_SCOPES as ae, MANAGEMENT_API_AUDIENCE as X, fetchAll as D, auth0QuerySchema as se, tenantSchema as q, tenantInsertSchema as U, deepMergePatch as oe, connectionSchema as ie, connectionOptionsSchema as ce, init as le } from "authhero";
+import { OpenAPIHono as ue, createRoute as M, z as I } from "@hono/zod-openapi";
+function de(e) {
   const { controlPlaneTenantId: t, requireOrganizationMatch: n = !0 } = e;
   return {
     async onTenantAccessValidation(r, a) {
       if (a === t)
         return !0;
       if (n) {
-        const s = r.var.org_name, c = r.var.organization_id, i = s || c;
-        return i ? i.toLowerCase() === a.toLowerCase() : !1;
+        const s = r.var.org_name, i = r.var.organization_id, c = s || i;
+        return c ? c.toLowerCase() === a.toLowerCase() : !1;
       }
       return !0;
     }
   };
 }
-function de(e, t, n, r) {
+function fe(e, t, n, r) {
   if (t === n)
     return !0;
   const a = r || e;
   return a ? a.toLowerCase() === t.toLowerCase() : !1;
 }
-function fe(e) {
+function me(e) {
   return {
     async resolveDataAdapters(t) {
       try {
@@ -39,31 +39,31 @@ function fe(e) {
     }
   };
 }
-function me(e) {
+function ge(e) {
   return `urn:authhero:tenant:${e.toLowerCase()}`;
 }
-function X(e) {
+function Y(e) {
   return {
     async beforeCreate(t, n) {
       return !n.audience && n.id ? {
         ...n,
-        audience: me(n.id)
+        audience: ge(n.id)
       } : n;
     },
     async afterCreate(t, n) {
       const { accessControl: r, databaseIsolation: a } = e;
-      r && t.ctx && await ge(t, n, r), a != null && a.onProvision && await a.onProvision(n.id);
+      r && t.ctx && await we(t, n, r), a != null && a.onProvision && await a.onProvision(n.id);
     },
     async beforeDelete(t, n) {
       const { accessControl: r, databaseIsolation: a } = e;
       if (r)
         try {
-          const c = (await t.adapters.organizations.list(
+          const i = (await t.adapters.organizations.list(
             r.controlPlaneTenantId
-          )).organizations.find((i) => i.name === n);
-          c && await t.adapters.organizations.remove(
+          )).organizations.find((c) => c.name === n);
+          i && await t.adapters.organizations.remove(
             r.controlPlaneTenantId,
-            c.id
+            i.id
           );
         } catch (s) {
           console.warn(
@@ -83,13 +83,13 @@ function X(e) {
     }
   };
 }
-async function ge(e, t, n) {
+async function we(e, t, n) {
   const {
     controlPlaneTenantId: r,
     defaultPermissions: a,
     defaultRoles: s,
-    issuer: c,
-    adminRoleName: i = "Tenant Admin",
+    issuer: i,
+    adminRoleName: c = "Tenant Admin",
     adminRoleDescription: u = "Full access to all tenant management operations",
     addCreatorToOrganization: o = !0
   } = n, l = await e.adapters.organizations.create(
@@ -100,14 +100,14 @@ async function ge(e, t, n) {
     }
   );
   let g;
-  if (c && (g = await pe(
+  if (i && (g = await pe(
     e,
     r,
-    i,
+    c,
     u
   )), o && e.ctx) {
     const d = e.ctx.var.user;
-    if (d != null && d.sub && !await we(
+    if (d != null && d.sub && !await he(
       e,
       r,
       d.sub
@@ -136,7 +136,7 @@ async function ge(e, t, n) {
     `Would grant permissions ${a.join(", ")} to organization ${l.id}`
   );
 }
-async function we(e, t, n) {
+async function he(e, t, n) {
   const r = await e.adapters.userRoles.list(
     t,
     n,
@@ -150,7 +150,7 @@ async function we(e, t, n) {
       a.id,
       { per_page: 1e3 }
     )).some(
-      (i) => i.permission_name === "admin:organizations"
+      (c) => c.permission_name === "admin:organizations"
     ))
       return !0;
   return !1;
@@ -159,23 +159,23 @@ async function pe(e, t, n, r) {
   const s = (await e.adapters.roles.list(t, {})).roles.find((o) => o.name === n);
   if (s)
     return s.id;
-  const c = await e.adapters.roles.create(t, {
+  const i = await e.adapters.roles.create(t, {
     name: n,
     description: r
-  }), i = J, u = re.map((o) => ({
-    role_id: c.id,
-    resource_server_identifier: i,
+  }), c = X, u = ae.map((o) => ({
+    role_id: i.id,
+    resource_server_identifier: c,
     permission_name: o.value
   }));
   return await e.adapters.rolePermissions.assign(
     t,
-    c.id,
+    i.id,
     u
-  ), c.id;
+  ), i.id;
 }
 function G(e, t, n = () => !0) {
-  const { controlPlaneTenantId: r, getChildTenantIds: a, getAdapters: s } = e, c = /* @__PURE__ */ new Map();
-  async function i(l, g, d) {
+  const { controlPlaneTenantId: r, getChildTenantIds: a, getAdapters: s } = e, i = /* @__PURE__ */ new Map();
+  async function c(l, g, d) {
     return (await t(l).list(g, {
       q: `name:${d}`,
       per_page: 1
@@ -189,7 +189,7 @@ function G(e, t, n = () => !0) {
           const m = await s(f), w = t(m), y = {
             ...d.transform(l),
             is_system: !0
-          }, _ = await i(m, f, l.name), b = _ ? w.getId(_) : void 0;
+          }, _ = await c(m, f, l.name), b = _ ? w.getId(_) : void 0;
           if (_ && b) {
             const P = w.preserveOnUpdate ? w.preserveOnUpdate(_, y) : y;
             await w.update(f, b, P);
@@ -209,7 +209,7 @@ function G(e, t, n = () => !0) {
     await Promise.all(
       g.map(async (d) => {
         try {
-          const f = await s(d), m = t(f), w = await i(f, d, l), C = w ? m.getId(w) : void 0;
+          const f = await s(d), m = t(f), w = await c(f, d, l), C = w ? m.getId(w) : void 0;
           w && C && await m.remove(d, C);
         } catch (f) {
           console.error(
@@ -230,22 +230,22 @@ function G(e, t, n = () => !0) {
     beforeDelete: async (l, g) => {
       if (l.tenantId !== r) return;
       const f = await t(l.adapters).get(l.tenantId, g);
-      f && n(f) && c.set(g, f);
+      f && n(f) && i.set(g, f);
     },
     afterDelete: async (l, g) => {
       if (l.tenantId !== r) return;
-      const d = c.get(g);
-      d && (c.delete(g), await o(d.name));
+      const d = i.get(g);
+      d && (i.delete(g), await o(d.name));
     }
   };
 }
-function L(e, t, n = () => !0) {
+function H(e, t, n = () => !0) {
   const { controlPlaneTenantId: r, getControlPlaneAdapters: a, getAdapters: s } = e;
   return {
-    async afterCreate(c, i) {
-      if (i.id !== r)
+    async afterCreate(i, c) {
+      if (c.id !== r)
         try {
-          const u = await a(), o = await s(i.id), l = t(u), g = t(o), d = await D(
+          const u = await a(), o = await s(c.id), l = t(u), g = t(o), d = await D(
             (f) => l.listPaginated(r, f),
             l.listKey,
             { cursorField: "id", pageSize: 100 }
@@ -254,13 +254,13 @@ function L(e, t, n = () => !0) {
             d.filter((f) => n(f)).map(async (f) => {
               try {
                 const m = l.transform(f);
-                await g.create(i.id, {
+                await g.create(c.id, {
                   ...m,
                   is_system: !0
                 });
               } catch (m) {
                 console.error(
-                  `Failed to sync entity to new tenant "${i.id}":`,
+                  `Failed to sync entity to new tenant "${c.id}":`,
                   m
                 );
               }
@@ -268,7 +268,7 @@ function L(e, t, n = () => !0) {
           );
         } catch (u) {
           console.error(
-            `Failed to sync entities to new tenant "${i.id}":`,
+            `Failed to sync entities to new tenant "${c.id}":`,
             u
           );
         }
@@ -293,7 +293,7 @@ const W = (e) => ({
     token_lifetime: t.token_lifetime,
     token_lifetime_for_web: t.token_lifetime_for_web
   })
-}), H = (e) => ({
+}), L = (e) => ({
   list: async (t, n) => (await e.roles.list(t, n)).roles,
   listPaginated: (t, n) => e.roles.list(t, n),
   get: (t, n) => e.roles.get(t, n),
@@ -312,19 +312,19 @@ function K(e) {
   var t;
   return ((t = e.metadata) == null ? void 0 : t.sync) !== !1;
 }
-function he(e) {
-  const { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, a = t.roles ?? !0, s = (m) => K(m) ? n.resourceServers ? n.resourceServers(m) : !0 : !1, c = (m) => K(m) ? n.roles ? n.roles(m) : !0 : !1, i = r ? G(
+function ye(e) {
+  const { sync: t = {}, filters: n = {} } = e, r = t.resourceServers ?? !0, a = t.roles ?? !0, s = (m) => K(m) ? n.resourceServers ? n.resourceServers(m) : !0 : !1, i = (m) => K(m) ? n.roles ? n.roles(m) : !0 : !1, c = r ? G(
     e,
     W,
     s
-  ) : void 0, u = a ? G(e, H, c) : void 0, o = r ? L(
+  ) : void 0, u = a ? G(e, L, i) : void 0, o = r ? H(
     e,
     W,
     s
-  ) : void 0, l = a ? L(
+  ) : void 0, l = a ? H(
     e,
-    H,
-    c
+    L,
+    i
   ) : void 0, g = a ? {
     async afterCreate(m, w) {
       var C;
@@ -332,53 +332,53 @@ function he(e) {
         await ((C = l == null ? void 0 : l.afterCreate) == null ? void 0 : C.call(l, m, w));
         try {
           const y = await e.getControlPlaneAdapters(), _ = await e.getAdapters(w.id), b = await D(
-            (p) => y.roles.list(
+            (h) => y.roles.list(
               e.controlPlaneTenantId,
-              p
+              h
             ),
             "roles",
             { cursorField: "id", pageSize: 100 }
           ), P = /* @__PURE__ */ new Map();
-          for (const p of b.filter(
+          for (const h of b.filter(
             (T) => {
-              var h;
-              return ((h = n.roles) == null ? void 0 : h.call(n, T)) ?? !0;
+              var p;
+              return ((p = n.roles) == null ? void 0 : p.call(n, T)) ?? !0;
             }
           )) {
             const T = await d(
               _,
               w.id,
-              p.name
+              h.name
             );
-            T && P.set(p.name, T.id);
+            T && P.set(h.name, T.id);
           }
-          for (const p of b.filter(
+          for (const h of b.filter(
             (T) => {
-              var h;
-              return ((h = n.roles) == null ? void 0 : h.call(n, T)) ?? !0;
+              var p;
+              return ((p = n.roles) == null ? void 0 : p.call(n, T)) ?? !0;
             }
           )) {
-            const T = P.get(p.name);
+            const T = P.get(h.name);
             if (T)
               try {
-                const h = await y.rolePermissions.list(
+                const p = await y.rolePermissions.list(
                   e.controlPlaneTenantId,
-                  p.id,
+                  h.id,
                   {}
                 );
-                h.length > 0 && await _.rolePermissions.assign(
+                p.length > 0 && await _.rolePermissions.assign(
                   w.id,
                   T,
-                  h.map((z) => ({
+                  p.map((z) => ({
                     role_id: T,
                     resource_server_identifier: z.resource_server_identifier,
                     permission_name: z.permission_name
                   }))
                 );
-              } catch (h) {
+              } catch (p) {
                 console.error(
-                  `Failed to sync permissions for role "${p.name}" to tenant "${w.id}":`,
-                  h
+                  `Failed to sync permissions for role "${h.name}" to tenant "${w.id}":`,
+                  p
                 );
               }
           }
@@ -399,7 +399,7 @@ function he(e) {
   }
   return {
     entityHooks: {
-      resourceServers: i,
+      resourceServers: c,
       roles: u
     },
     tenantHooks: {
@@ -433,8 +433,8 @@ var A = class extends Error {
    */
   constructor(t = 500, n) {
     super(n == null ? void 0 : n.message, { cause: n == null ? void 0 : n.cause });
-    E(this, "res");
-    E(this, "status");
+    O(this, "res");
+    O(this, "status");
     this.res = n == null ? void 0 : n.res, this.status = t;
   }
   /**
@@ -452,14 +452,14 @@ var A = class extends Error {
   }
 };
 function N(e, t) {
-  const n = new le();
+  const n = new ue();
   return n.openapi(
     M({
       tags: ["tenants"],
       method: "get",
       path: "/",
       request: {
-        query: ae
+        query: se
       },
       security: [
         {
@@ -484,24 +484,24 @@ function N(e, t) {
     }),
     async (r) => {
       var m, w, C, y, _, b;
-      const a = r.req.valid("query"), { page: s, per_page: c, include_totals: i, q: u } = a, o = r.var.user, l = (o == null ? void 0 : o.permissions) || [];
+      const a = r.req.valid("query"), { page: s, per_page: i, include_totals: c, q: u } = a, o = r.var.user, l = (o == null ? void 0 : o.permissions) || [];
       if (l.includes("auth:read") || l.includes("admin:organizations")) {
         const P = await r.env.data.tenants.list({
           page: s,
-          per_page: c,
-          include_totals: i,
+          per_page: i,
+          include_totals: c,
           q: u
         });
-        return i ? r.json({
+        return c ? r.json({
           tenants: P.tenants,
           start: ((m = P.totals) == null ? void 0 : m.start) ?? 0,
-          limit: ((w = P.totals) == null ? void 0 : w.limit) ?? c,
+          limit: ((w = P.totals) == null ? void 0 : w.limit) ?? i,
           length: P.tenants.length
         }) : r.json({ tenants: P.tenants });
       }
       const d = ((C = e.accessControl) == null ? void 0 : C.controlPlaneTenantId) ?? ((y = r.env.data.multiTenancyConfig) == null ? void 0 : y.controlPlaneTenantId);
       if (d && (o != null && o.sub)) {
-        const p = (await D(
+        const h = (await D(
           (R) => r.env.data.userOrganizations.listUserOrganizations(
             d,
             o.sub,
@@ -509,44 +509,44 @@ function N(e, t) {
           ),
           "organizations"
         )).map((R) => R.name);
-        if (p.length === 0)
-          return i ? r.json({
+        if (h.length === 0)
+          return c ? r.json({
             tenants: [],
             start: 0,
-            limit: c ?? 50,
+            limit: i ?? 50,
             length: 0
           }) : r.json({ tenants: [] });
-        const T = p.length, h = s ?? 0, z = c ?? 50, F = h * z, j = p.slice(F, F + z);
-        if (j.length === 0)
-          return i ? r.json({
+        const T = h.length, p = s ?? 0, z = i ?? 50, j = p * z, F = h.slice(j, j + z);
+        if (F.length === 0)
+          return c ? r.json({
             tenants: [],
-            start: F,
+            start: j,
             limit: z,
             length: T
           }) : r.json({ tenants: [] });
-        const S = j.map((R) => `id:${R}`).join(" OR "), v = u ? `(${S}) AND (${u})` : S, $ = await r.env.data.tenants.list({
+        const S = F.map((R) => `id:${R}`).join(" OR "), v = u ? `(${S}) AND (${u})` : S, $ = await r.env.data.tenants.list({
           q: v,
           per_page: z,
           include_totals: !1
           // We calculate totals from accessibleTenantIds
         });
-        return i ? r.json({
+        return c ? r.json({
           tenants: $.tenants,
-          start: F,
+          start: j,
           limit: z,
           length: T
         }) : r.json({ tenants: $.tenants });
       }
       const f = await r.env.data.tenants.list({
         page: s,
-        per_page: c,
-        include_totals: i,
+        per_page: i,
+        include_totals: c,
         q: u
       });
-      return i ? r.json({
+      return c ? r.json({
         tenants: f.tenants,
         start: ((_ = f.totals) == null ? void 0 : _.start) ?? 0,
-        limit: ((b = f.totals) == null ? void 0 : b.limit) ?? c,
+        limit: ((b = f.totals) == null ? void 0 : b.limit) ?? i,
         length: f.tenants.length
       }) : r.json({ tenants: f.tenants });
     }
@@ -594,13 +594,13 @@ function N(e, t) {
           message: "Authentication required to create tenants"
         });
       let s = r.req.valid("json");
-      const c = {
+      const i = {
         adapters: r.env.data,
         ctx: r
       };
-      (u = t.tenants) != null && u.beforeCreate && (s = await t.tenants.beforeCreate(c, s));
-      const i = await r.env.data.tenants.create(s);
-      return (o = t.tenants) != null && o.afterCreate && await t.tenants.afterCreate(c, i), r.json(i, 201);
+      (u = t.tenants) != null && u.beforeCreate && (s = await t.tenants.beforeCreate(i, s));
+      const c = await r.env.data.tenants.create(s);
+      return (o = t.tenants) != null && o.afterCreate && await t.tenants.afterCreate(i, c), r.json(c, 201);
     }
   ), n.openapi(
     M({
@@ -658,11 +658,11 @@ function N(e, t) {
         throw new A(404, {
           message: "Tenant not found"
         });
-      const i = {
+      const c = {
         adapters: r.env.data,
         ctx: r
       };
-      return (l = t.tenants) != null && l.beforeDelete && await t.tenants.beforeDelete(i, a), await r.env.data.tenants.remove(a), (g = t.tenants) != null && g.afterDelete && await t.tenants.afterDelete(i, a), r.body(null, 204);
+      return (l = t.tenants) != null && l.beforeDelete && await t.tenants.beforeDelete(c, a), await r.env.data.tenants.remove(a), (g = t.tenants) != null && g.afterDelete && await t.tenants.afterDelete(c, a), r.body(null, 204);
     }
   ), n.openapi(
     M({
@@ -732,12 +732,12 @@ function N(e, t) {
       }
     }),
     async (r) => {
-      const a = r.req.valid("json"), { id: s, ...c } = a, i = await r.env.data.tenants.get(r.var.tenant_id);
-      if (!i)
+      const a = r.req.valid("json"), { id: s, ...i } = a, c = await r.env.data.tenants.get(r.var.tenant_id);
+      if (!c)
         throw new A(404, {
           message: "Tenant not found"
         });
-      const u = se(i, c);
+      const u = oe(c, i);
       await r.env.data.tenants.update(r.var.tenant_id, u);
       const o = await r.env.data.tenants.get(r.var.tenant_id);
       if (!o)
@@ -748,7 +748,7 @@ function N(e, t) {
     }
   ), n;
 }
-function ye(e) {
+function ve(e) {
   const t = [
     {
       pattern: /\/api\/v2\/resource-servers\/([^/]+)$/,
@@ -764,7 +764,7 @@ function ye(e) {
   }
   return null;
 }
-async function ve(e, t, n) {
+async function _e(e, t, n) {
   try {
     switch (n.type) {
       case "resource_server": {
@@ -786,50 +786,50 @@ async function ve(e, t, n) {
     return !1;
   }
 }
-function _e(e) {
+function Ce(e) {
   return {
     resource_server: "resource server",
     role: "role",
     connection: "connection"
   }[e];
 }
-function Ce() {
+function Te() {
   return async (e, t) => {
     if (!["PATCH", "PUT", "DELETE"].includes(e.req.method))
       return t();
-    const n = ye(e.req.path);
+    const n = ve(e.req.path);
     if (!n)
       return t();
     const r = e.var.tenant_id || e.req.header("x-tenant-id") || e.req.header("tenant-id");
     if (!r)
       return t();
-    if (await ve(e.env.data, r, n))
+    if (await _e(e.env.data, r, n))
       throw new A(403, {
-        message: `This ${_e(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
+        message: `This ${Ce(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return t();
   };
 }
-function k(e, t) {
+function E(e, t) {
   const n = t.find(
     (a) => a.strategy === e.strategy
   );
   if (!(n != null && n.options))
     return e;
-  const r = oe.passthrough().parse({
+  const r = ie.passthrough().parse({
     ...n,
     ...e
   });
-  return r.options = ie.passthrough().parse({
+  return r.options = ce.passthrough().parse({
     ...n.options || {},
     ...e.options
   }), r;
 }
-function O(e, t) {
+function k(e, t) {
   const n = [...t || [], ...e || []];
   return [...new Set(n)];
 }
-function Te(e, t) {
+function be(e, t) {
   if (!(t != null && t.length))
     return e || [];
   if (!(e != null && e.length))
@@ -844,7 +844,7 @@ function Te(e, t) {
 function Q(e, t) {
   return t ? {
     ...e,
-    scopes: Te(
+    scopes: be(
       e.scopes,
       t.scopes
     )
@@ -853,22 +853,22 @@ function Q(e, t) {
 function V(e, t) {
   return t ? {
     ...e,
-    callbacks: O(e.callbacks, t.callbacks),
-    web_origins: O(
+    callbacks: k(e.callbacks, t.callbacks),
+    web_origins: k(
       e.web_origins,
       t.web_origins
     ),
-    allowed_logout_urls: O(
+    allowed_logout_urls: k(
       e.allowed_logout_urls,
       t.allowed_logout_urls
     ),
-    allowed_origins: O(
+    allowed_origins: k(
       e.allowed_origins,
       t.allowed_origins
     )
   } : e;
 }
-function Y(e, t) {
+function Z(e, t) {
   return {
     ...e.resourceServers,
     get: async (n, r) => {
@@ -891,22 +891,22 @@ function Y(e, t) {
       const a = await e.resourceServers.list(n, r);
       if (!t || n === t)
         return a;
-      const s = t, c = a.resource_servers.filter(
+      const s = t, i = a.resource_servers.filter(
         (o) => !!(o.is_system && o.id)
       ).map((o) => o.id);
-      if (c.length === 0)
+      if (i.length === 0)
         return a;
-      const i = /* @__PURE__ */ new Map();
+      const c = /* @__PURE__ */ new Map();
       await Promise.all(
-        c.map(async (o) => {
+        i.map(async (o) => {
           const l = await e.resourceServers.get(s, o);
-          l && i.set(o, l);
+          l && c.set(o, l);
         })
       );
       const u = a.resource_servers.map(
         (o) => o.is_system && o.id ? Q(
           o,
-          i.get(o.id) ?? null
+          c.get(o.id) ?? null
         ) : o
       );
       return {
@@ -916,16 +916,16 @@ function Y(e, t) {
     }
   };
 }
-function be(e, t) {
+function Pe(e, t) {
   return {
     ...e,
-    resourceServers: Y(
+    resourceServers: Z(
       e,
       t.controlPlaneTenantId
     )
   };
 }
-function Pe(e, t) {
+function Ae(e, t) {
   const { controlPlaneTenantId: n, controlPlaneClientId: r } = t;
   return {
     ...e,
@@ -937,30 +937,30 @@ function Pe(e, t) {
     connections: {
       ...e.connections,
       get: async (a, s) => {
-        const c = await e.connections.get(
+        const i = await e.connections.get(
           a,
           s
         );
-        if (!c || !n || a === n)
-          return c;
-        const i = await e.connections.list(n);
-        return k(
-          c,
-          i.connections || []
+        if (!i || !n || a === n)
+          return i;
+        const c = await e.connections.list(n);
+        return E(
+          i,
+          c.connections || []
         );
       },
       list: async (a, s) => {
-        const c = await e.connections.list(a, s);
+        const i = await e.connections.list(a, s);
         if (!n || a === n)
-          return c;
-        const i = await e.connections.list(n), u = c.connections.map(
-          (o) => k(
+          return i;
+        const c = await e.connections.list(n), u = i.connections.map(
+          (o) => E(
             o,
-            i.connections || []
+            c.connections || []
           )
         );
         return {
-          ...c,
+          ...i,
           connections: u
         };
       }
@@ -968,17 +968,17 @@ function Pe(e, t) {
     clientConnections: {
       ...e.clientConnections,
       listByClient: async (a, s) => {
-        let c = await e.clientConnections.listByClient(
+        let i = await e.clientConnections.listByClient(
           a,
           s
         );
-        if (c.length === 0 && (c = (await e.connections.list(a)).connections || []), !n || a === n)
-          return c;
-        const i = await e.connections.list(n);
-        return c.map(
-          (u) => k(
+        if (i.length === 0 && (i = (await e.connections.list(a)).connections || []), !n || a === n)
+          return i;
+        const c = await e.connections.list(n);
+        return i.map(
+          (u) => E(
             u,
-            i.connections || []
+            c.connections || []
           )
         );
       }
@@ -986,16 +986,16 @@ function Pe(e, t) {
     clients: {
       ...e.clients,
       get: async (a, s) => {
-        const c = await e.clients.get(a, s);
-        if (!c)
+        const i = await e.clients.get(a, s);
+        if (!i)
           return null;
         if (!n || !r || a === n && s === r)
-          return c;
-        const i = await e.clients.get(
+          return i;
+        const c = await e.clients.get(
           n,
           r
         );
-        return V(c, i);
+        return V(i, c);
       },
       getByClientId: async (a) => {
         const s = await e.clients.getByClientId(a);
@@ -1003,12 +1003,12 @@ function Pe(e, t) {
           return null;
         if (!n || !r || s.tenant_id === n && s.client_id === r)
           return s;
-        const c = await e.clients.get(
+        const i = await e.clients.get(
           n,
           r
         );
         return {
-          ...V(s, c),
+          ...V(s, i),
           tenant_id: s.tenant_id
         };
       }
@@ -1020,48 +1020,90 @@ function Pe(e, t) {
         return s || (!n || a === n ? null : e.emailProviders.get(n));
       }
     },
-    resourceServers: Y(
+    resourceServers: Z(
       e,
       n
-    )
+    ),
+    hooks: Se(e, n)
     // Note: Additional adapters can be extended here for runtime fallback:
     // - promptSettings: Fall back to control plane prompts
     // - branding: Fall back to control plane branding/themes
   };
 }
-function Z(e, t) {
-  return Pe(e, t);
+function J(e) {
+  if (!e || typeof e != "object") return !1;
+  const t = e.metadata;
+  return !t || typeof t != "object" ? !1 : t.inheritable === !0;
 }
-function Ae(e) {
+function Se(e, t) {
+  return {
+    ...e.hooks,
+    list: async (n, r) => {
+      const a = await e.hooks.list(n, r);
+      if (!t || n === t)
+        return a;
+      const i = ((await e.hooks.list(
+        t,
+        r
+      )).hooks || []).filter(
+        J
+      );
+      if (i.length === 0)
+        return a;
+      const c = new Set(
+        (a.hooks || []).map((o) => o.hook_id)
+      ), u = i.filter((o) => !c.has(o.hook_id));
+      return {
+        ...a,
+        hooks: [...a.hooks || [], ...u],
+        length: typeof a.length == "number" ? a.length + u.length : a.length
+      };
+    },
+    get: async (n, r) => {
+      const a = await e.hooks.get(n, r);
+      if (a || !t || n === t)
+        return a;
+      const s = await e.hooks.get(
+        t,
+        r
+      );
+      return s && J(s) ? s : null;
+    }
+  };
+}
+function x(e, t) {
+  return Ae(e, t);
+}
+function Ie(e) {
   return async (t, n) => {
     const r = t.var.user;
     return (r == null ? void 0 : r.tenant_id) === e && r.org_name && t.set("tenant_id", r.org_name), n();
   };
 }
-function Se(e) {
+function Re(e) {
   return async (t, n) => {
     if (!e.accessControl)
       return n();
-    const { controlPlaneTenantId: r } = e.accessControl, a = t.var.org_name, s = t.var.organization_id, c = a || s;
-    let i = t.var.tenant_id;
-    const u = t.var.user, l = (u != null && u.aud ? Array.isArray(u.aud) ? u.aud : [u.aud] : []).includes(J);
-    if (!i && c && l && (t.set("tenant_id", c), i = c), !i)
+    const { controlPlaneTenantId: r } = e.accessControl, a = t.var.org_name, s = t.var.organization_id, i = a || s;
+    let c = t.var.tenant_id;
+    const u = t.var.user, l = (u != null && u.aud ? Array.isArray(u.aud) ? u.aud : [u.aud] : []).includes(X);
+    if (!c && i && l && (t.set("tenant_id", i), c = i), !c)
       throw new A(400, {
         message: "Tenant ID not found in request"
       });
-    if (!de(
+    if (!fe(
       s,
-      i,
+      c,
       r,
       a
     ))
       throw new A(403, {
-        message: `Access denied to tenant ${i}`
+        message: `Access denied to tenant ${c}`
       });
     return n();
   };
 }
-function Ie(e) {
+function ze(e) {
   return async (t, n) => {
     if (!e.subdomainRouting)
       return n();
@@ -1069,34 +1111,34 @@ function Ie(e) {
       baseDomain: r,
       reservedSubdomains: a = [],
       resolveSubdomain: s
-    } = e.subdomainRouting, c = t.req.header("x-forwarded-host") || t.req.header("host") || "";
-    let i = null;
-    if (c.endsWith(r)) {
-      const o = c.slice(0, -(r.length + 1));
-      o && !o.includes(".") && (i = o);
+    } = e.subdomainRouting, i = t.req.header("x-forwarded-host") || t.req.header("host") || "";
+    let c = null;
+    if (i.endsWith(r)) {
+      const o = i.slice(0, -(r.length + 1));
+      o && !o.includes(".") && (c = o);
     }
-    if (i && a.includes(i) && (i = null), !i)
+    if (c && a.includes(c) && (c = null), !c)
       return e.accessControl && t.set("tenant_id", e.accessControl.controlPlaneTenantId), n();
     let u = null;
     if (s)
-      u = await s(i);
+      u = await s(c);
     else if (e.subdomainRouting.useOrganizations !== !1 && e.accessControl)
       try {
         const o = await t.env.data.organizations.get(
           e.accessControl.controlPlaneTenantId,
-          i
+          c
         );
         o && (u = o.id);
       } catch {
       }
     if (!u)
       throw new A(404, {
-        message: `Tenant not found for subdomain: ${i}`
+        message: `Tenant not found for subdomain: ${c}`
       });
     return t.set("tenant_id", u), n();
   };
 }
-function Re(e) {
+function $e(e) {
   return async (t, n) => {
     if (!e.databaseIsolation)
       return n();
@@ -1119,14 +1161,14 @@ function Re(e) {
     return n();
   };
 }
-function x(e) {
-  const t = Ie(e), n = Se(e), r = Re(e);
+function ee(e) {
+  const t = ze(e), n = Re(e), r = $e(e);
   return async (a, s) => (await t(a, async () => {
   }), await n(a, async () => {
   }), await r(a, async () => {
   }), s());
 }
-function De(e) {
+function ke(e) {
   const {
     dataAdapter: t,
     controlPlane: n,
@@ -1135,8 +1177,8 @@ function De(e) {
       clientId: a
     } = {},
     sync: s = { resourceServers: !0, roles: !0 },
-    defaultPermissions: c = ["tenant:admin"],
-    requireOrganizationMatch: i = !1,
+    defaultPermissions: i = ["tenant:admin"],
+    requireOrganizationMatch: c = !1,
     managementApiExtensions: u = [],
     entityHooks: o,
     getChildTenantIds: l,
@@ -1144,11 +1186,11 @@ function De(e) {
     ...d
   } = e;
   let f = t, m = t;
-  n && (f = Z(t, {
+  n && (f = x(t, {
     controlPlaneTenantId: r,
     controlPlaneClientId: a
   }), m = {
-    ...be(t, {
+    ...Pe(t, {
       controlPlaneTenantId: r
     }),
     multiTenancyConfig: {
@@ -1169,7 +1211,7 @@ function De(e) {
     getAdapters: g ?? (async () => f),
     getControlPlaneAdapters: async () => f,
     sync: C
-  }, { entityHooks: P, tenantHooks: p } = he(b), T = {
+  }, { entityHooks: P, tenantHooks: h } = ye(b), T = {
     resourceServers: [
       P.resourceServers,
       ...(o == null ? void 0 : o.resourceServers) ?? []
@@ -1178,54 +1220,54 @@ function De(e) {
     connections: (o == null ? void 0 : o.connections) ?? [],
     tenants: (o == null ? void 0 : o.tenants) ?? [],
     rolePermissions: (o == null ? void 0 : o.rolePermissions) ?? []
-  }, h = X({
+  }, p = Y({
     accessControl: {
       controlPlaneTenantId: r,
-      requireOrganizationMatch: i,
-      defaultPermissions: c
+      requireOrganizationMatch: c,
+      defaultPermissions: i
     }
-  }), F = N(
+  }), j = N(
     {
       accessControl: {
         controlPlaneTenantId: r,
-        requireOrganizationMatch: i,
-        defaultPermissions: c
+        requireOrganizationMatch: c,
+        defaultPermissions: i
       }
     },
     { tenants: {
       async beforeCreate(S, v) {
-        return h.beforeCreate && (v = await h.beforeCreate(S, v)), p.beforeCreate && (v = await p.beforeCreate(S, v)), v;
+        return p.beforeCreate && (v = await p.beforeCreate(S, v)), h.beforeCreate && (v = await h.beforeCreate(S, v)), v;
       },
       async afterCreate(S, v) {
         var $, R;
-        await (($ = h.afterCreate) == null ? void 0 : $.call(h, S, v)), await ((R = p.afterCreate) == null ? void 0 : R.call(p, S, v));
+        await (($ = p.afterCreate) == null ? void 0 : $.call(p, S, v)), await ((R = h.afterCreate) == null ? void 0 : R.call(h, S, v));
       },
       async beforeDelete(S, v) {
         var $, R;
-        await (($ = h.beforeDelete) == null ? void 0 : $.call(h, S, v)), await ((R = p.beforeDelete) == null ? void 0 : R.call(p, S, v));
+        await (($ = p.beforeDelete) == null ? void 0 : $.call(p, S, v)), await ((R = h.beforeDelete) == null ? void 0 : R.call(h, S, v));
       }
     } }
-  ), { app: j } = ce({
+  ), { app: F } = le({
     dataAdapter: f,
     managementDataAdapter: m,
     ...d,
     entityHooks: T,
     managementApiExtensions: [
       ...u,
-      { path: "/tenants", router: F }
+      { path: "/tenants", router: j }
     ]
   });
-  return j.use(
+  return F.use(
     "/api/v2/*",
-    Ae(r)
-  ), w && j.use("/api/v2/*", Ce()), { app: j, controlPlaneTenantId: r };
+    Ie(r)
+  ), w && F.use("/api/v2/*", Te()), { app: F, controlPlaneTenantId: r };
 }
-function qe(e) {
+function Oe(e) {
   const t = B(e);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
-    middleware: x(e),
+    middleware: ee(e),
     // Provide lifecycle hooks
     hooks: t,
     // Mount tenant management routes
@@ -1246,22 +1288,22 @@ function qe(e) {
   };
 }
 function B(e) {
-  const t = e.accessControl ? ue(e.accessControl) : {}, n = e.databaseIsolation ? fe(e.databaseIsolation) : {}, r = X(e);
+  const t = e.accessControl ? de(e.accessControl) : {}, n = e.databaseIsolation ? me(e.databaseIsolation) : {}, r = Y(e);
   return {
     ...t,
     ...n,
     tenants: r
   };
 }
-function ze(e) {
-  const t = new ne(), n = B(e);
+function je(e) {
+  const t = new re(), n = B(e);
   return t.route("/tenants", N(e, n)), t;
 }
-function Oe(e) {
+function Ee(e) {
   return {
     hooks: B(e),
-    middleware: x(e),
-    app: ze(e),
+    middleware: ee(e),
+    app: je(e),
     config: e,
     /**
      * Wraps data adapters with runtime fallback from the control plane.
@@ -1273,7 +1315,7 @@ function Oe(e) {
      */
     wrapAdapters: (t, n) => {
       var r;
-      return Z(t, {
+      return x(t, {
         controlPlaneTenantId: (r = e.accessControl) == null ? void 0 : r.controlPlaneTenantId,
         controlPlaneClientId: n == null ? void 0 : n.controlPlaneClientId
       });
@@ -1281,24 +1323,24 @@ function Oe(e) {
   };
 }
 export {
-  ue as createAccessControlHooks,
-  Se as createAccessControlMiddleware,
-  Ae as createControlPlaneTenantMiddleware,
-  fe as createDatabaseHooks,
-  Re as createDatabaseMiddleware,
-  ze as createMultiTenancy,
+  de as createAccessControlHooks,
+  Re as createAccessControlMiddleware,
+  Ie as createControlPlaneTenantMiddleware,
+  me as createDatabaseHooks,
+  $e as createDatabaseMiddleware,
+  je as createMultiTenancy,
   B as createMultiTenancyHooks,
-  x as createMultiTenancyMiddleware,
-  qe as createMultiTenancyPlugin,
-  Ce as createProtectSyncedMiddleware,
-  X as createProvisioningHooks,
-  Pe as createRuntimeFallbackAdapter,
-  Ie as createSubdomainMiddleware,
-  he as createSyncHooks,
+  ee as createMultiTenancyMiddleware,
+  Oe as createMultiTenancyPlugin,
+  Te as createProtectSyncedMiddleware,
+  Y as createProvisioningHooks,
+  Ae as createRuntimeFallbackAdapter,
+  ze as createSubdomainMiddleware,
+  ye as createSyncHooks,
   N as createTenantsOpenAPIRouter,
-  De as initMultiTenant,
-  Oe as setupMultiTenancy,
-  de as validateTenantAccess,
-  Z as withRuntimeFallback,
-  be as withSystemResourceServerInheritance
+  ke as initMultiTenant,
+  Ee as setupMultiTenancy,
+  fe as validateTenantAccess,
+  x as withRuntimeFallback,
+  Pe as withSystemResourceServerInheritance
 };

package/dist/types/middleware/settings-inheritance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAOb,MAAM,UAAU,CAAC;AAmNlB;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE;IAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC,YAAY,CAQd;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAyMd;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}
+{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAOb,MAAM,UAAU,CAAC;AAmNlB;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE;IAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC,YAAY,CAQd;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CA2Md;AA2FD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "14.20.0",
+  "version": "14.20.1",
   "description": "Multi-tenancy support for AuthHero with organization-based access control and per-tenant database isolation",
   "files": [
     "dist"
@@ -36,9 +36,9 @@
     "typescript": "^5.6.0",
     "vite": "^6.0.0",
     "vitest": "^2.1.0",
-    "@authhero/kysely-adapter": "10.125.0",
-    "authhero": "4.98.0",
-    "@authhero/adapter-interfaces": "1.4.0"
+    "@authhero/kysely-adapter": "10.131.4",
+    "authhero": "4.107.0",
+    "@authhero/adapter-interfaces": "1.10.2"
   },
   "dependencies": {
     "zod": "^3.24.0"