@authhero/multi-tenancy 14.22.0 → 14.23.1

package/dist/multi-tenancy.cjs

@@ -1 +1 @@
-"use strict";var ue=Object.defineProperty;var de=(e,t,r)=>t in e?ue(e,t,{enumerable:!0,configurable:!0,writable:!0,value:r}):e[t]=r;var E=(e,t,r)=>de(e,typeof t!="symbol"?t+"":t,r);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const fe=require("hono"),v=require("authhero"),_=require("@hono/zod-openapi");function X(e){const{controlPlaneTenantId:t,requireOrganizationMatch:r=!0}=e;return{async onTenantAccessValidation(n,a){if(a===t)return!0;if(r){const o=n.var.org_name,c=n.var.organization_id,i=o||c;return i?i.toLowerCase()===a.toLowerCase():!1}return!0}}}function Y(e,t,r,n){if(t===r)return!0;const a=n||e;return a?a.toLowerCase()===t.toLowerCase():!1}function Z(e){return{async resolveDataAdapters(t){try{return await e.getAdapters(t)}catch(r){console.error(`Failed to resolve data adapters for tenant ${t}:`,r);return}}}}function me(e){return`urn:authhero:tenant:${e.toLowerCase()}`}function H(e){return{async beforeCreate(t,r){return!r.audience&&r.id?{...r,audience:me(r.id)}:r},async afterCreate(t,r){const{accessControl:n,databaseIsolation:a}=e;n&&t.ctx&&await ge(t,r,n),a!=null&&a.onProvision&&await a.onProvision(r.id)},async beforeDelete(t,r){const{accessControl:n,databaseIsolation:a}=e;if(n)try{const c=(await t.adapters.organizations.list(n.controlPlaneTenantId)).organizations.find(i=>i.name===r);c&&await t.adapters.organizations.remove(n.controlPlaneTenantId,c.id)}catch(o){console.warn(`Failed to remove organization for tenant ${r}:`,o)}if(a!=null&&a.onDeprovision)try{await a.onDeprovision(r)}catch(o){console.warn(`Failed to deprovision database for tenant ${r}:`,o)}}}}async function ge(e,t,r){const{controlPlaneTenantId:n,defaultPermissions:a,defaultRoles:o,issuer:c,adminRoleName:i="Tenant Admin",adminRoleDescription:l="Full access to all tenant management operations",addCreatorToOrganization:u=!0}=r,s=await e.adapters.organizations.create(n,{name:t.id,display_name:t.friendly_name||t.id});let d;if(c&&(d=await pe(e,n,i,l)),u&&e.ctx){const m=e.ctx.var.user;if(m!=null&&m.sub&&!await we(e,n,m.sub))try{await e.adapters.userOrganizations.create(n,{user_id:m.sub,organization_id:s.id}),d&&await e.adapters.userRoles.create(n,m.sub,d,s.id)}catch(f){console.warn(`Failed to add creator ${m.sub} to organization ${s.id}:`,f)}}o&&o.length>0&&console.log(`Would assign roles ${o.join(", ")} to organization ${s.id}`),a&&a.length>0&&console.log(`Would grant permissions ${a.join(", ")} to organization ${s.id}`)}async function we(e,t,r){const n=await e.adapters.userRoles.list(t,r,void 0,"");for(const a of n)if((await e.adapters.rolePermissions.list(t,a.id,{per_page:1e3})).some(i=>i.permission_name==="admin:organizations"))return!0;return!1}async function pe(e,t,r,n){const o=(await e.adapters.roles.list(t,{})).roles.find(u=>u.name===r);if(o)return o.id;const c=await e.adapters.roles.create(t,{name:r,description:n}),i=v.MANAGEMENT_API_AUDIENCE,l=v.MANAGEMENT_API_SCOPES.map(u=>({role_id:c.id,resource_server_identifier:i,permission_name:u.value}));return await e.adapters.rolePermissions.assign(t,c.id,l),c.id}function G(e,t,r=()=>!0){const{controlPlaneTenantId:n,getChildTenantIds:a,getAdapters:o}=e,c=new Map;async function i(s,d,m){return(await t(s).list(d,{q:`name:${m}`,per_page:1}))[0]??null}async function l(s){const d=await a(),m=t(await o(n));await Promise.all(d.map(async w=>{try{const f=await o(w),g=t(f),h={...m.transform(s),is_system:!0},b=await i(f,w,s.name),A=b?g.getId(b):void 0;if(b&&A){const M=g.preserveOnUpdate?g.preserveOnUpdate(b,h):h;await g.update(w,A,M)}else await g.create(w,h)}catch(f){console.error(`Failed to sync ${m.listKey} "${s.name}" to tenant "${w}":`,f)}}))}async function u(s){const d=await a();await Promise.all(d.map(async m=>{try{const w=await o(m),f=t(w),g=await i(w,m,s),C=g?f.getId(g):void 0;g&&C&&await f.remove(m,C)}catch(w){console.error(`Failed to delete entity "${s}" from tenant "${m}":`,w)}}))}return{afterCreate:async(s,d)=>{s.tenantId===n&&r(d)&&await l(d)},afterUpdate:async(s,d,m)=>{s.tenantId===n&&r(m)&&await l(m)},beforeDelete:async(s,d)=>{if(s.tenantId!==n)return;const w=await t(s.adapters).get(s.tenantId,d);w&&r(w)&&c.set(d,w)},afterDelete:async(s,d)=>{if(s.tenantId!==n)return;const m=c.get(d);m&&(c.delete(d),await u(m.name))}}}function W(e,t,r=()=>!0){const{controlPlaneTenantId:n,getControlPlaneAdapters:a,getAdapters:o}=e;return{async afterCreate(c,i){if(i.id!==n)try{const l=await a(),u=await o(i.id),s=t(l),d=t(u),m=await v.fetchAll(w=>s.listPaginated(n,w),s.listKey,{cursorField:"id",pageSize:100});await Promise.all(m.filter(w=>r(w)).map(async w=>{try{const f=s.transform(w);await d.create(i.id,{...f,is_system:!0})}catch(f){console.error(`Failed to sync entity to new tenant "${i.id}":`,f)}}))}catch(l){console.error(`Failed to sync entities to new tenant "${i.id}":`,l)}}}}const L=e=>({list:async(t,r)=>(await e.resourceServers.list(t,r)).resource_servers,listPaginated:(t,r)=>e.resourceServers.list(t,r),get:(t,r)=>e.resourceServers.get(t,r),create:(t,r)=>e.resourceServers.create(t,r),update:(t,r,n)=>e.resourceServers.update(t,r,n),remove:(t,r)=>e.resourceServers.remove(t,r),listKey:"resource_servers",getId:t=>t.id,transform:t=>({id:t.id,name:t.name,identifier:t.identifier,scopes:t.scopes,signing_alg:t.signing_alg,token_lifetime:t.token_lifetime,token_lifetime_for_web:t.token_lifetime_for_web})}),K=e=>({list:async(t,r)=>(await e.roles.list(t,r)).roles,listPaginated:(t,r)=>e.roles.list(t,r),get:(t,r)=>e.roles.get(t,r),create:(t,r)=>e.roles.create(t,r),update:(t,r,n)=>e.roles.update(t,r,n),remove:(t,r)=>e.roles.remove(t,r),listKey:"roles",getId:t=>t.id,transform:t=>({id:t.id,name:t.name,description:t.description})});function Q(e){var t;return((t=e.metadata)==null?void 0:t.sync)!==!1}function x(e){const{sync:t={},filters:r={}}=e,n=t.resourceServers??!0,a=t.roles??!0,o=f=>Q(f)?r.resourceServers?r.resourceServers(f):!0:!1,c=f=>Q(f)?r.roles?r.roles(f):!0:!1,i=n?G(e,L,o):void 0,l=a?G(e,K,c):void 0,u=n?W(e,L,o):void 0,s=a?W(e,K,c):void 0,d=a?{async afterCreate(f,g){var C;if(g.id!==e.controlPlaneTenantId){await((C=s==null?void 0:s.afterCreate)==null?void 0:C.call(s,f,g));try{const h=await e.getControlPlaneAdapters(),b=await e.getAdapters(g.id),A=await v.fetchAll(T=>h.roles.list(e.controlPlaneTenantId,T),"roles",{cursorField:"id",pageSize:100}),M=new Map;for(const T of A.filter(p=>{var P;return((P=r.roles)==null?void 0:P.call(r,p))??!0})){const p=await m(b,g.id,T.name);p&&M.set(T.name,p.id)}for(const T of A.filter(p=>{var P;return((P=r.roles)==null?void 0:P.call(r,p))??!0})){const p=M.get(T.name);if(p)try{const P=await h.rolePermissions.list(e.controlPlaneTenantId,T.id,{});P.length>0&&await b.rolePermissions.assign(g.id,p,P.map(S=>({role_id:p,resource_server_identifier:S.resource_server_identifier,permission_name:S.permission_name})))}catch(P){console.error(`Failed to sync permissions for role "${T.name}" to tenant "${g.id}":`,P)}}}catch(h){console.error(`Failed to sync role permissions to tenant "${g.id}":`,h)}}}}:void 0;async function m(f,g,C){return(await f.roles.list(g,{q:`name:${C}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:i,roles:l},tenantHooks:{async afterCreate(f,g){const C=[u==null?void 0:u.afterCreate,(d==null?void 0:d.afterCreate)??(s==null?void 0:s.afterCreate)],h=[];for(const b of C)if(b)try{await b(f,g)}catch(A){h.push(A instanceof Error?A:new Error(String(A)))}if(h.length===1)throw h[0];if(h.length>1)throw new AggregateError(h,h.map(b=>b.message).join("; "))}}}}var I=class extends Error{constructor(t=500,r){super(r==null?void 0:r.message,{cause:r==null?void 0:r.cause});E(this,"res");E(this,"status");this.res=r==null?void 0:r.res,this.status=t}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function D(e,t){const r=new _.OpenAPIHono;return r.openapi(_.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:v.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:_.z.object({tenants:_.z.array(v.tenantSchema),start:_.z.number().optional(),limit:_.z.number().optional(),length:_.z.number().optional()})}},description:"List of tenants"}}}),async n=>{var g,C,h,b,A,M;const a=n.req.valid("query"),{page:o,per_page:c,include_totals:i,q:l}=a,u=n.var.user,s=(u==null?void 0:u.permissions)||[];if(!!!((u==null?void 0:u.org_id)??n.var.organization_id)&&s.includes("admin:organizations")){const T=await n.env.data.tenants.list({page:o,per_page:c,include_totals:i,q:l});return i?n.json({tenants:T.tenants,start:((g=T.totals)==null?void 0:g.start)??0,limit:((C=T.totals)==null?void 0:C.limit)??c,length:T.tenants.length}):n.json({tenants:T.tenants})}const w=((h=e.accessControl)==null?void 0:h.controlPlaneTenantId)??((b=n.env.data.multiTenancyConfig)==null?void 0:b.controlPlaneTenantId);if(w&&!(u!=null&&u.sub))throw new I(403,{message:"Access denied: token has no subject"});if(w&&(u!=null&&u.sub)){const p=(await v.fetchAll(R=>n.env.data.userOrganizations.listUserOrganizations(w,u.sub,R),"organizations")).map(R=>R.name);if(p.length===0)return i?n.json({tenants:[],start:0,limit:c??50,length:0}):n.json({tenants:[]});const P=p.length,S=o??0,j=c??50,F=S*j,$=p.slice(F,F+j);if($.length===0)return i?n.json({tenants:[],start:F,limit:j,length:P}):n.json({tenants:[]});const z=$.map(R=>`id:${R}`).join(" OR "),y=l?`(${z}) AND (${l})`:z,k=await n.env.data.tenants.list({q:y,per_page:j,include_totals:!1});return i?n.json({tenants:k.tenants,start:F,limit:j,length:P}):n.json({tenants:k.tenants})}const f=await n.env.data.tenants.list({page:o,per_page:c,include_totals:i,q:l});return i?n.json({tenants:f.tenants,start:((A=f.totals)==null?void 0:A.start)??0,limit:((M=f.totals)==null?void 0:M.limit)??c,length:f.tenants.length}):n.json({tenants:f.tenants})}),r.openapi(_.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:v.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:v.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async n=>{var l,u;const a=n.var.user;if(!(a!=null&&a.sub))throw new I(401,{message:"Authentication required to create tenants"});let o=n.req.valid("json");const c={adapters:n.env.data,ctx:n};(l=t.tenants)!=null&&l.beforeCreate&&(o=await t.tenants.beforeCreate(c,o));const i=await n.env.data.tenants.create(o);return(u=t.tenants)!=null&&u.afterCreate&&await t.tenants.afterCreate(c,i),n.json(i,201)}),r.openapi(_.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:_.z.object({id:_.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async n=>{var l,u,s,d;const{id:a}=n.req.valid("param"),o=((l=e.accessControl)==null?void 0:l.controlPlaneTenantId)??((u=n.env.data.multiTenancyConfig)==null?void 0:u.controlPlaneTenantId);if(o){const m=n.var.user;if(!(m!=null&&m.sub))throw new I(401,{message:"Authentication required"});if(a===o)throw new I(403,{message:"Cannot delete the control plane"});if(!(await v.fetchAll(g=>n.env.data.userOrganizations.listUserOrganizations(o,m.sub,g),"organizations")).some(g=>g.name===a))throw new I(403,{message:"Access denied to this tenant"})}if(!await n.env.data.tenants.get(a))throw new I(404,{message:"Tenant not found"});const i={adapters:n.env.data,ctx:n};return(s=t.tenants)!=null&&s.beforeDelete&&await t.tenants.beforeDelete(i,a),await n.env.data.tenants.remove(a),(d=t.tenants)!=null&&d.afterDelete&&await t.tenants.afterDelete(i,a),n.body(null,204)}),r.openapi(_.createRoute({tags:["tenants","settings"],method:"get",path:"/settings",request:{headers:_.z.object({"tenant-id":_.z.string().optional()})},security:[{Bearer:["read:tenants"]}],responses:{200:{content:{"application/json":{schema:v.tenantSchema}},description:"Current tenant settings"}}}),async n=>{const a=await n.env.data.tenants.get(n.var.tenant_id);if(!a)throw new I(404,{message:"Tenant not found"});return n.json(a)}),r.openapi(_.createRoute({tags:["tenants","settings"],method:"patch",path:"/settings",request:{headers:_.z.object({"tenant-id":_.z.string().optional()}),body:{content:{"application/json":{schema:_.z.object(v.tenantInsertSchema.shape).partial()}}}},security:[{Bearer:["update:tenants"]}],responses:{200:{content:{"application/json":{schema:v.tenantSchema}},description:"Updated tenant settings"}}}),async n=>{const a=n.req.valid("json"),{id:o,...c}=a,i=await n.env.data.tenants.get(n.var.tenant_id);if(!i)throw new I(404,{message:"Tenant not found"});const l=v.deepMergePatch(i,c);await n.env.data.tenants.update(n.var.tenant_id,l);const u=await n.env.data.tenants.get(n.var.tenant_id);if(!u)throw new I(500,{message:"Failed to retrieve updated tenant"});return n.json(u)}),r}function he(e){const t=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:r,type:n}of t){const a=e.match(r);if(a&&a[1])return{type:n,id:a[1]}}return null}async function ye(e,t,r){try{switch(r.type){case"resource_server":{const n=await e.resourceServers.get(t,r.id);return(n==null?void 0:n.is_system)===!0}case"role":{const n=await e.roles.get(t,r.id);return(n==null?void 0:n.is_system)===!0}case"connection":{const n=await e.connections.get(t,r.id);return(n==null?void 0:n.is_system)===!0}default:return!1}}catch{return!1}}function ve(e){return{resource_server:"resource server",role:"role",connection:"connection"}[e]}function ee(){return async(e,t)=>{if(!["PATCH","PUT","DELETE"].includes(e.req.method))return t();const r=he(e.req.path);if(!r)return t();const n=e.var.tenant_id||e.req.header("x-tenant-id")||e.req.header("tenant-id");if(!n)return t();if(await ye(e.env.data,n,r))throw new I(403,{message:`This ${ve(r.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return t()}}function N(e,t){const r=t.find(a=>a.strategy===e.strategy);if(!(r!=null&&r.options))return e;const n=v.connectionSchema.passthrough().parse({...r,...e});return n.options=v.connectionOptionsSchema.passthrough().parse({...r.options||{},...e.options}),n}function q(e,t){const r=[...t||[],...e||[]];return[...new Set(r)]}function Te(e,t){if(!(t!=null&&t.length))return e||[];if(!(e!=null&&e.length))return t;const r=new Map;for(const n of t)r.set(n.value,n);for(const n of e)r.set(n.value,n);return Array.from(r.values())}function V(e,t){return t?{...e,scopes:Te(e.scopes,t.scopes)}:e}function _e(e,t){return t?{...e,callbacks:q(e.callbacks,t.callbacks),web_origins:q(e.web_origins,t.web_origins),allowed_logout_urls:q(e.allowed_logout_urls,t.allowed_logout_urls),allowed_origins:q(e.allowed_origins,t.allowed_origins)}:e}function te(e){const{controlPlaneTenantId:t,controlPlaneClientId:r,resolveControlPlane:n}=e;if(n)return async o=>n({tenant_id:o});if(!t)return async()=>{};const a={tenantId:t,clientId:r};return async()=>a}function ne(e,t){return{...e.resourceServers,get:async(r,n)=>{const a=await e.resourceServers.get(r,n);if(!a)return a;const o=await t(r);if(!o||r===o.tenantId||!a.is_system)return a;const c=await e.resourceServers.get(o.tenantId,n);return V(a,c)},list:async(r,n)=>{const a=await e.resourceServers.list(r,n),o=await t(r);if(!o||r===o.tenantId)return a;const c=o.tenantId,i=a.resource_servers.filter(s=>!!(s.is_system&&s.id)).map(s=>s.id);if(i.length===0)return a;const l=new Map;await Promise.all(i.map(async s=>{const d=await e.resourceServers.get(c,s);d&&l.set(s,d)}));const u=a.resource_servers.map(s=>s.is_system&&s.id?V(s,l.get(s.id)??null):s);return{...a,resource_servers:u}}}}function re(e,t){const r=te({controlPlaneTenantId:t.controlPlaneTenantId,resolveControlPlane:t.resolveControlPlane});return{...e,resourceServers:ne(e,r)}}function ae(e,t){const{controlPlaneTenantId:r,controlPlaneClientId:n,resolveControlPlane:a}=t,o=te({controlPlaneTenantId:r,controlPlaneClientId:n,resolveControlPlane:a});return{...e,multiTenancyConfig:{controlPlaneTenantId:r,controlPlaneClientId:n,resolveControlPlane:a},connections:{...e.connections,get:async(c,i)=>{const l=await e.connections.get(c,i);if(!l)return l;const u=await o(c);if(!u||c===u.tenantId)return l;const s=await e.connections.list(u.tenantId);return N(l,s.connections||[])},list:async(c,i)=>{const l=await e.connections.list(c,i),u=await o(c);if(!u||c===u.tenantId)return l;const s=await e.connections.list(u.tenantId),d=l.connections.map(m=>N(m,s.connections||[]));return{...l,connections:d}}},clientConnections:{...e.clientConnections,listByClient:async(c,i)=>{let l=await e.clientConnections.listByClient(c,i);l.length===0&&(l=(await e.connections.list(c)).connections||[]);const u=await o(c);if(!u||c===u.tenantId)return l;const s=await e.connections.list(u.tenantId);return l.map(d=>N(d,s.connections||[]))}},emailProviders:{...e.emailProviders,get:async c=>{const i=await e.emailProviders.get(c);if(i)return i;const l=await o(c);return!l||c===l.tenantId?null:e.emailProviders.get(l.tenantId)}},resourceServers:ne(e,o),hooks:Ce(e,o)}}function J(e){if(!e||typeof e!="object")return!1;const t=e.metadata;return!t||typeof t!="object"?!1:t.inheritable===!0}function Ce(e,t){return{...e.hooks,list:async(r,n)=>{const a=await e.hooks.list(r,n),o=await t(r);if(!o||r===o.tenantId)return a;const i=((await e.hooks.list(o.tenantId,n)).hooks||[]).filter(J);if(i.length===0)return a;const l=new Set((a.hooks||[]).map(s=>s.hook_id)),u=i.filter(s=>!l.has(s.hook_id));return{...a,hooks:[...a.hooks||[],...u],length:typeof a.length=="number"?a.length+u.length:a.length}},get:async(r,n)=>{const a=await e.hooks.get(r,n);if(a)return a;const o=await t(r);if(!o||r===o.tenantId)return a;const c=await e.hooks.get(o.tenantId,n);return c&&J(c)?c:null}}}function B(e,t){return ae(e,t)}function se(e){return async(t,r)=>{const n=t.var.user;return(n==null?void 0:n.tenant_id)===e&&n.org_name&&t.set("tenant_id",n.org_name),r()}}function oe(e){return async(t,r)=>{if(!e.accessControl)return r();const{controlPlaneTenantId:n}=e.accessControl,a=t.var.org_name,o=t.var.organization_id,c=a||o;let i=t.var.tenant_id;const l=t.var.user,s=(l!=null&&l.aud?Array.isArray(l.aud)?l.aud:[l.aud]:[]).includes(v.MANAGEMENT_API_AUDIENCE);if(!i&&c&&s&&(t.set("tenant_id",c),i=c),!i)throw new I(400,{message:"Tenant ID not found in request"});if(!Y(o,i,n,a))throw new I(403,{message:`Access denied to tenant ${i}`});return r()}}function ie(e){return async(t,r)=>{if(!e.subdomainRouting)return r();const{baseDomain:n,reservedSubdomains:a=[],resolveSubdomain:o}=e.subdomainRouting,c=t.req.header("x-forwarded-host")||t.req.header("host")||"";let i=null;if(c.endsWith(n)){const u=c.slice(0,-(n.length+1));u&&!u.includes(".")&&(i=u)}if(i&&a.includes(i)&&(i=null),!i)return e.accessControl&&t.set("tenant_id",e.accessControl.controlPlaneTenantId),r();let l=null;if(o)l=await o(i);else if(e.subdomainRouting.useOrganizations!==!1&&e.accessControl)try{const u=await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId,i);u&&(l=u.id)}catch{}if(!l)throw new I(404,{message:`Tenant not found for subdomain: ${i}`});return t.set("tenant_id",l),r()}}function ce(e){return async(t,r)=>{if(!e.databaseIsolation)return r();const n=t.var.tenant_id;if(!n)throw new I(400,{message:"Tenant ID not found in request"});try{const a=await e.databaseIsolation.getAdapters(n);t.env.data=a}catch(a){throw console.error(`Failed to resolve database for tenant ${n}:`,a),new I(500,{message:"Failed to resolve tenant database"})}return r()}}function U(e){const t=ie(e),r=oe(e),n=ce(e);return async(a,o)=>(await t(a,async()=>{}),await r(a,async()=>{}),await n(a,async()=>{}),o())}function be(e){const{dataAdapter:t,controlPlane:r,controlPlane:{tenantId:n="control_plane",clientId:a}={},resolveControlPlane:o,sync:c={resourceServers:!0,roles:!0},defaultPermissions:i=["tenant:admin"],requireOrganizationMatch:l=!1,managementApiExtensions:u=[],entityHooks:s,getChildTenantIds:d,getAdapters:m,...w}=e;if(o&&!r)throw new Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");let f=t,g=t;r&&(f=B(t,{controlPlaneTenantId:n,controlPlaneClientId:a,resolveControlPlane:o}),g={...re(t,{controlPlaneTenantId:n,resolveControlPlane:o}),multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:a,resolveControlPlane:o}});const C=c!==!1,h=C?{resourceServers:c.resourceServers??!0,roles:c.roles??!0}:{resourceServers:!1,roles:!1},M={controlPlaneTenantId:n,getChildTenantIds:d??(async()=>(await v.fetchAll(y=>f.tenants.list(y),"tenants",{cursorField:"id",pageSize:100})).filter(y=>y.id!==n).map(y=>y.id)),getAdapters:m??(async()=>f),getControlPlaneAdapters:async()=>f,sync:h},{entityHooks:T,tenantHooks:p}=x(M),P={resourceServers:[T.resourceServers,...(s==null?void 0:s.resourceServers)??[]],roles:[T.roles,...(s==null?void 0:s.roles)??[]],connections:(s==null?void 0:s.connections)??[],tenants:(s==null?void 0:s.tenants)??[],rolePermissions:(s==null?void 0:s.rolePermissions)??[]},S=H({accessControl:{controlPlaneTenantId:n,requireOrganizationMatch:l,defaultPermissions:i}}),F=D({accessControl:{controlPlaneTenantId:n,requireOrganizationMatch:l,defaultPermissions:i}},{tenants:{async beforeCreate(z,y){return S.beforeCreate&&(y=await S.beforeCreate(z,y)),p.beforeCreate&&(y=await p.beforeCreate(z,y)),y},async afterCreate(z,y){var k,R;await((k=S.afterCreate)==null?void 0:k.call(S,z,y)),await((R=p.afterCreate)==null?void 0:R.call(p,z,y))},async beforeDelete(z,y){var k,R;await((k=S.beforeDelete)==null?void 0:k.call(S,z,y)),await((R=p.beforeDelete)==null?void 0:R.call(p,z,y))}}}),{app:$}=v.init({dataAdapter:f,managementDataAdapter:g,...w,entityHooks:P,managementApiExtensions:[...u,{path:"/tenants",router:F}]});return $.use("/api/v2/*",se(n)),C&&$.use("/api/v2/*",ee()),{app:$,controlPlaneTenantId:n}}function Pe(e){const t=O(e);return{name:"multi-tenancy",middleware:U(e),hooks:t,routes:[{path:"/management",handler:D(e,t)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),e.accessControl&&console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`),e.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`),e.databaseIsolation&&console.log("  - Database isolation enabled")}}}function O(e){const t=e.accessControl?X(e.accessControl):{},r=e.databaseIsolation?Z(e.databaseIsolation):{},n=H(e);return{...t,...r,tenants:n}}function le(e){const t=new fe.Hono,r=O(e);return t.route("/tenants",D(e,r)),t}function Ie(e){return{hooks:O(e),middleware:U(e),app:le(e),config:e,wrapAdapters:(t,r)=>{var n;return B(t,{controlPlaneTenantId:(n=e.accessControl)==null?void 0:n.controlPlaneTenantId,controlPlaneClientId:r==null?void 0:r.controlPlaneClientId})}}}exports.createAccessControlHooks=X;exports.createAccessControlMiddleware=oe;exports.createControlPlaneTenantMiddleware=se;exports.createDatabaseHooks=Z;exports.createDatabaseMiddleware=ce;exports.createMultiTenancy=le;exports.createMultiTenancyHooks=O;exports.createMultiTenancyMiddleware=U;exports.createMultiTenancyPlugin=Pe;exports.createProtectSyncedMiddleware=ee;exports.createProvisioningHooks=H;exports.createRuntimeFallbackAdapter=ae;exports.createSubdomainMiddleware=ie;exports.createSyncHooks=x;exports.createTenantsOpenAPIRouter=D;exports.initMultiTenant=be;exports.mergeClientWithFallback=_e;exports.setupMultiTenancy=Ie;exports.validateTenantAccess=Y;exports.withRuntimeFallback=B;exports.withSystemResourceServerInheritance=re;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("hono"),t=require("authhero"),n=require("@hono/zod-openapi");function r(e){let{controlPlaneTenantId:t,requireOrganizationMatch:n=!0}=e;return{async onTenantAccessValidation(e,r){if(r===t)return!0;if(n){let t=e.var.org_name,n=e.var.organization_id,i=t||n;return i?i.toLowerCase()===r.toLowerCase():!1}return!0}}}function i(e,t,n,r){if(t===n)return!0;let i=r||e;return i?i.toLowerCase()===t.toLowerCase():!1}function a(e){return{async resolveDataAdapters(t){try{return await e.getAdapters(t)}catch(e){console.error(`Failed to resolve data adapters for tenant ${t}:`,e);return}}}}function o(e){return`urn:authhero:tenant:${e.toLowerCase()}`}function s(e){return{async beforeCreate(e,t){return!t.audience&&t.id?{...t,audience:o(t.id)}:t},async afterCreate(t,n){let{accessControl:r,databaseIsolation:i}=e;r&&t.ctx&&await c(t,n,r),i?.onProvision&&await i.onProvision(n.id)},async beforeDelete(t,n){let{accessControl:r,databaseIsolation:i}=e;if(r)try{let e=(await t.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find(e=>e.name===n);e&&await t.adapters.organizations.remove(r.controlPlaneTenantId,e.id)}catch(e){console.warn(`Failed to remove organization for tenant ${n}:`,e)}if(i?.onDeprovision)try{await i.onDeprovision(n)}catch(e){console.warn(`Failed to deprovision database for tenant ${n}:`,e)}}}}async function c(e,t,n){let{controlPlaneTenantId:r,defaultPermissions:i,defaultRoles:a,issuer:o,adminRoleName:s=`Tenant Admin`,adminRoleDescription:c=`Full access to all tenant management operations`,addCreatorToOrganization:d=!0}=n,f=await e.adapters.organizations.create(r,{name:t.id,display_name:t.friendly_name||t.id}),p;if(o&&(p=await u(e,r,s,c)),d&&e.ctx){let t=e.ctx.var.user;if(t?.sub&&!await l(e,r,t.sub))try{await e.adapters.userOrganizations.create(r,{user_id:t.sub,organization_id:f.id}),p&&await e.adapters.userRoles.create(r,t.sub,p,f.id)}catch(e){console.warn(`Failed to add creator ${t.sub} to organization ${f.id}:`,e)}}a&&a.length>0&&console.log(`Would assign roles ${a.join(`, `)} to organization ${f.id}`),i&&i.length>0&&console.log(`Would grant permissions ${i.join(`, `)} to organization ${f.id}`)}async function l(e,t,n){let r=await e.adapters.userRoles.list(t,n,void 0,``);for(let n of r)if((await e.adapters.rolePermissions.list(t,n.id,{per_page:1e3})).some(e=>e.permission_name===`admin:organizations`))return!0;return!1}async function u(e,n,r,i){let a=(await e.adapters.roles.list(n,{})).roles.find(e=>e.name===r);if(a)return a.id;let o=await e.adapters.roles.create(n,{name:r,description:i}),s=t.MANAGEMENT_API_AUDIENCE,c=t.MANAGEMENT_API_SCOPES.map(e=>({role_id:o.id,resource_server_identifier:s,permission_name:e.value}));return await e.adapters.rolePermissions.assign(n,o.id,c),o.id}function d(e,t,n=()=>!0){let{controlPlaneTenantId:r,getChildTenantIds:i,getAdapters:a}=e,o=new Map;async function s(e,n,r){return(await t(e).list(n,{q:`name:${r}`,per_page:1}))[0]??null}async function c(e){let n=await i(),o=t(await a(r));await Promise.all(n.map(async n=>{try{let r=await a(n),i=t(r),c={...o.transform(e),is_system:!0},l=await s(r,n,e.name),u=l?i.getId(l):void 0;if(l&&u){let e=i.preserveOnUpdate?i.preserveOnUpdate(l,c):c;await i.update(n,u,e)}else await i.create(n,c)}catch(t){console.error(`Failed to sync ${o.listKey} "${e.name}" to tenant "${n}":`,t)}}))}async function l(e){let n=await i();await Promise.all(n.map(async n=>{try{let r=await a(n),i=t(r),o=await s(r,n,e),c=o?i.getId(o):void 0;o&&c&&await i.remove(n,c)}catch(t){console.error(`Failed to delete entity "${e}" from tenant "${n}":`,t)}}))}return{afterCreate:async(e,t)=>{e.tenantId===r&&n(t)&&await c(t)},afterUpdate:async(e,t,i)=>{e.tenantId===r&&n(i)&&await c(i)},beforeDelete:async(e,i)=>{if(e.tenantId!==r)return;let a=await t(e.adapters).get(e.tenantId,i);a&&n(a)&&o.set(i,a)},afterDelete:async(e,t)=>{if(e.tenantId!==r)return;let n=o.get(t);n&&(o.delete(t),await l(n.name))}}}function f(e,n,r=()=>!0){let{controlPlaneTenantId:i,getControlPlaneAdapters:a,getAdapters:o}=e;return{async afterCreate(e,s){if(s.id!==i)try{let e=await a(),c=await o(s.id),l=n(e),u=n(c),d=await(0,t.fetchAll)(e=>l.listPaginated(i,e),l.listKey,{cursorField:`id`,pageSize:100});await Promise.all(d.filter(e=>r(e)).map(async e=>{try{let t=l.transform(e);await u.create(s.id,{...t,is_system:!0})}catch(e){console.error(`Failed to sync entity to new tenant "${s.id}":`,e)}}))}catch(e){console.error(`Failed to sync entities to new tenant "${s.id}":`,e)}}}}var p=e=>({list:async(t,n)=>(await e.resourceServers.list(t,n)).resource_servers,listPaginated:(t,n)=>e.resourceServers.list(t,n),get:(t,n)=>e.resourceServers.get(t,n),create:(t,n)=>e.resourceServers.create(t,n),update:(t,n,r)=>e.resourceServers.update(t,n,r),remove:(t,n)=>e.resourceServers.remove(t,n),listKey:`resource_servers`,getId:e=>e.id,transform:e=>({id:e.id,name:e.name,identifier:e.identifier,scopes:e.scopes,signing_alg:e.signing_alg,token_lifetime:e.token_lifetime,token_lifetime_for_web:e.token_lifetime_for_web})}),m=e=>({list:async(t,n)=>(await e.roles.list(t,n)).roles,listPaginated:(t,n)=>e.roles.list(t,n),get:(t,n)=>e.roles.get(t,n),create:(t,n)=>e.roles.create(t,n),update:(t,n,r)=>e.roles.update(t,n,r),remove:(t,n)=>e.roles.remove(t,n),listKey:`roles`,getId:e=>e.id,transform:e=>({id:e.id,name:e.name,description:e.description})});function h(e){return e.metadata?.sync!==!1}function g(e){let{sync:n={},filters:r={}}=e,i=n.resourceServers??!0,a=n.roles??!0,o=e=>h(e)?r.resourceServers?r.resourceServers(e):!0:!1,s=e=>h(e)?r.roles?r.roles(e):!0:!1,c=i?d(e,p,o):void 0,l=a?d(e,m,s):void 0,u=i?f(e,p,o):void 0,g=a?f(e,m,s):void 0,_=a?{async afterCreate(n,i){if(i.id!==e.controlPlaneTenantId){await g?.afterCreate?.(n,i);try{let n=await e.getControlPlaneAdapters(),a=await e.getAdapters(i.id),o=await(0,t.fetchAll)(t=>n.roles.list(e.controlPlaneTenantId,t),`roles`,{cursorField:`id`,pageSize:100}),s=new Map;for(let e of o.filter(e=>r.roles?.(e)??!0)){let t=await v(a,i.id,e.name);t&&s.set(e.name,t.id)}for(let t of o.filter(e=>r.roles?.(e)??!0)){let r=s.get(t.name);if(r)try{let o=await n.rolePermissions.list(e.controlPlaneTenantId,t.id,{});o.length>0&&await a.rolePermissions.assign(i.id,r,o.map(e=>({role_id:r,resource_server_identifier:e.resource_server_identifier,permission_name:e.permission_name})))}catch(e){console.error(`Failed to sync permissions for role "${t.name}" to tenant "${i.id}":`,e)}}}catch(e){console.error(`Failed to sync role permissions to tenant "${i.id}":`,e)}}}}:void 0;async function v(e,t,n){return(await e.roles.list(t,{q:`name:${n}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:c,roles:l},tenantHooks:{async afterCreate(e,t){let n=[u?.afterCreate,_?.afterCreate??g?.afterCreate],r=[];for(let i of n)if(i)try{await i(e,t)}catch(e){r.push(e instanceof Error?e:Error(String(e)))}if(r.length===1)throw r[0];if(r.length>1)throw AggregateError(r,r.map(e=>e.message).join(`; `))}}}}var _=class extends Error{res;status;constructor(e=500,t){super(t?.message,{cause:t?.cause}),this.res=t?.res,this.status=e}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function v(e,r){let i=new n.OpenAPIHono;return i.openapi((0,n.createRoute)({tags:[`tenants`],method:`get`,path:`/`,request:{query:t.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:n.z.object({tenants:n.z.array(t.tenantSchema),start:n.z.number().optional(),limit:n.z.number().optional(),length:n.z.number().optional()})}},description:`List of tenants`}}}),async n=>{let{page:r,per_page:i,include_totals:a,q:o}=n.req.valid(`query`),s=n.var.user,c=s?.permissions||[];if(!(s?.org_id??n.var.organization_id)&&c.includes(`admin:organizations`)){let e=await n.env.data.tenants.list({page:r,per_page:i,include_totals:a,q:o});return a?n.json({tenants:e.tenants,start:e.totals?.start??0,limit:e.totals?.limit??i,length:e.tenants.length}):n.json({tenants:e.tenants})}let l=e.accessControl?.controlPlaneTenantId??n.env.data.multiTenancyConfig?.controlPlaneTenantId;if(l&&!s?.sub)throw new _(403,{message:`Access denied: token has no subject`});if(l&&s?.sub){let e=(await(0,t.fetchAll)(e=>n.env.data.userOrganizations.listUserOrganizations(l,s.sub,e),`organizations`)).map(e=>e.name);if(e.length===0)return a?n.json({tenants:[],start:0,limit:i??50,length:0}):n.json({tenants:[]});let c=e.length,u=r??0,d=i??50,f=u*d,p=e.slice(f,f+d);if(p.length===0)return a?n.json({tenants:[],start:f,limit:d,length:c}):n.json({tenants:[]});let m=p.map(e=>`id:${e}`).join(` OR `),h=o?`(${m}) AND (${o})`:m,g=await n.env.data.tenants.list({q:h,per_page:d,include_totals:!1});return a?n.json({tenants:g.tenants,start:f,limit:d,length:c}):n.json({tenants:g.tenants})}let u=await n.env.data.tenants.list({page:r,per_page:i,include_totals:a,q:o});return a?n.json({tenants:u.tenants,start:u.totals?.start??0,limit:u.totals?.limit??i,length:u.tenants.length}):n.json({tenants:u.tenants})}),i.openapi((0,n.createRoute)({tags:[`tenants`],method:`post`,path:`/`,request:{body:{content:{"application/json":{schema:t.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:t.tenantSchema}},description:`Tenant created`},400:{description:`Validation error`},409:{description:`Tenant with this ID already exists`}}}),async e=>{if(!e.var.user?.sub)throw new _(401,{message:`Authentication required to create tenants`});let t=e.req.valid(`json`),n={adapters:e.env.data,ctx:e};r.tenants?.beforeCreate&&(t=await r.tenants.beforeCreate(n,t));let i=await e.env.data.tenants.create(t);return r.tenants?.afterCreate&&await r.tenants.afterCreate(n,i),e.json(i,201)}),i.openapi((0,n.createRoute)({tags:[`tenants`],method:`delete`,path:`/{id}`,request:{params:n.z.object({id:n.z.string()})},security:[{Bearer:[`delete:tenants`]}],responses:{204:{description:`Tenant deleted`},403:{description:`Access denied or cannot delete the control plane`},404:{description:`Tenant not found`}}}),async n=>{let{id:i}=n.req.valid(`param`),a=e.accessControl?.controlPlaneTenantId??n.env.data.multiTenancyConfig?.controlPlaneTenantId;if(a){let e=n.var.user;if(!e?.sub)throw new _(401,{message:`Authentication required`});if(i===a)throw new _(403,{message:`Cannot delete the control plane`});let r=n.var.org_name,o=i.toLowerCase(),s=!!r&&r.toLowerCase()===o;if(s||=(await(0,t.fetchAll)(t=>n.env.data.userOrganizations.listUserOrganizations(a,e.sub,t),`organizations`)).some(e=>e.name?.toLowerCase()===o),!s)throw new _(403,{message:`Access denied to this tenant`})}if(!await n.env.data.tenants.get(i))throw new _(404,{message:`Tenant not found`});let o={adapters:n.env.data,ctx:n};return r.tenants?.beforeDelete&&await r.tenants.beforeDelete(o,i),await n.env.data.tenants.remove(i),r.tenants?.afterDelete&&await r.tenants.afterDelete(o,i),n.body(null,204)}),i.openapi((0,n.createRoute)({tags:[`tenants`,`settings`],method:`get`,path:`/settings`,request:{headers:n.z.object({"tenant-id":n.z.string().optional()})},security:[{Bearer:[`read:tenants`]}],responses:{200:{content:{"application/json":{schema:t.tenantSchema}},description:`Current tenant settings`}}}),async e=>{let t=await e.env.data.tenants.get(e.var.tenant_id);if(!t)throw new _(404,{message:`Tenant not found`});return e.json(t)}),i.openapi((0,n.createRoute)({tags:[`tenants`,`settings`],method:`patch`,path:`/settings`,request:{headers:n.z.object({"tenant-id":n.z.string().optional()}),body:{content:{"application/json":{schema:n.z.object(t.tenantInsertSchema.shape).partial()}}}},security:[{Bearer:[`update:tenants`]}],responses:{200:{content:{"application/json":{schema:t.tenantSchema}},description:`Updated tenant settings`}}}),async e=>{let{id:n,...r}=e.req.valid(`json`),i=await e.env.data.tenants.get(e.var.tenant_id);if(!i)throw new _(404,{message:`Tenant not found`});let a=(0,t.deepMergePatch)(i,r);await e.env.data.tenants.update(e.var.tenant_id,a);let o=await e.env.data.tenants.get(e.var.tenant_id);if(!o)throw new _(500,{message:`Failed to retrieve updated tenant`});return e.json(o)}),i}function y(e){for(let{pattern:t,type:n}of[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:`resource_server`},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:`role`},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:`connection`}]){let r=e.match(t);if(r&&r[1])return{type:n,id:r[1]}}return null}async function b(e,t,n){try{switch(n.type){case`resource_server`:return(await e.resourceServers.get(t,n.id))?.is_system===!0;case`role`:return(await e.roles.get(t,n.id))?.is_system===!0;case`connection`:return(await e.connections.get(t,n.id))?.is_system===!0;default:return!1}}catch{return!1}}function x(e){return{resource_server:`resource server`,role:`role`,connection:`connection`}[e]}function S(){return async(e,t)=>{if(![`PATCH`,`PUT`,`DELETE`].includes(e.req.method))return t();let n=y(e.req.path);if(!n)return t();let r=e.var.tenant_id||e.req.header(`x-tenant-id`)||e.req.header(`tenant-id`);if(!r)return t();if(await b(e.env.data,r,n))throw new _(403,{message:`This ${x(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return t()}}function C(e,n){let r=n.find(t=>t.strategy===e.strategy);if(!r?.options)return e;let i=t.connectionSchema.passthrough().parse({...r,...e});return i.options=t.connectionOptionsSchema.passthrough().parse({...r.options||{},...e.options}),i}function w(e,t){let n=[...t||[],...e||[]];return[...new Set(n)]}function T(e,t){if(!t?.length)return e||[];if(!e?.length)return t;let n=new Map;for(let e of t)n.set(e.value,e);for(let t of e)n.set(t.value,t);return Array.from(n.values())}function E(e,t){return t?{...e,scopes:T(e.scopes,t.scopes)}:e}function D(e,t){return t?{...e,callbacks:w(e.callbacks,t.callbacks),web_origins:w(e.web_origins,t.web_origins),allowed_logout_urls:w(e.allowed_logout_urls,t.allowed_logout_urls),allowed_origins:w(e.allowed_origins,t.allowed_origins)}:e}function O(e){let{controlPlaneTenantId:t,controlPlaneClientId:n,resolveControlPlane:r}=e;if(r)return async e=>r({tenant_id:e});if(!t)return async()=>void 0;let i={tenantId:t,clientId:n};return async()=>i}function k(e,t){return{...e.resourceServers,get:async(n,r)=>{let i=await e.resourceServers.get(n,r);if(!i)return i;let a=await t(n);return!a||n===a.tenantId||!i.is_system?i:E(i,await e.resourceServers.get(a.tenantId,r))},list:async(n,r)=>{let i=await e.resourceServers.list(n,r),a=await t(n);if(!a||n===a.tenantId)return i;let o=a.tenantId,s=i.resource_servers.filter(e=>!!(e.is_system&&e.id)).map(e=>e.id);if(s.length===0)return i;let c=new Map;await Promise.all(s.map(async t=>{let n=await e.resourceServers.get(o,t);n&&c.set(t,n)}));let l=i.resource_servers.map(e=>e.is_system&&e.id?E(e,c.get(e.id)??null):e);return{...i,resource_servers:l}}}}function A(e,t){let n=O({controlPlaneTenantId:t.controlPlaneTenantId,resolveControlPlane:t.resolveControlPlane});return{...e,resourceServers:k(e,n)}}function j(e,t){let{controlPlaneTenantId:n,controlPlaneClientId:r,resolveControlPlane:i}=t,a=O({controlPlaneTenantId:n,controlPlaneClientId:r,resolveControlPlane:i});return{...e,multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:r,resolveControlPlane:i},connections:{...e.connections,get:async(t,n)=>{let r=await e.connections.get(t,n);if(!r)return r;let i=await a(t);return!i||t===i.tenantId?r:C(r,(await e.connections.list(i.tenantId)).connections||[])},list:async(t,n)=>{let r=await e.connections.list(t,n),i=await a(t);if(!i||t===i.tenantId)return r;let o=await e.connections.list(i.tenantId),s=r.connections.map(e=>C(e,o.connections||[]));return{...r,connections:s}}},clientConnections:{...e.clientConnections,listByClient:async(t,n)=>{let r=await e.clientConnections.listByClient(t,n);r.length===0&&(r=(await e.connections.list(t)).connections||[]);let i=await a(t);if(!i||t===i.tenantId)return r;let o=await e.connections.list(i.tenantId);return r.map(e=>C(e,o.connections||[]))}},emailProviders:{...e.emailProviders,get:async t=>{let n=await e.emailProviders.get(t);if(n)return n;let r=await a(t);return!r||t===r.tenantId?null:e.emailProviders.get(r.tenantId)}},resourceServers:k(e,a),hooks:N(e,a)}}function M(e){if(!e||typeof e!=`object`)return!1;let t=e.metadata;return!t||typeof t!=`object`?!1:t.inheritable===!0}function N(e,t){return{...e.hooks,list:async(n,r)=>{let i=await e.hooks.list(n,r),a=await t(n);if(!a||n===a.tenantId)return i;let o=((await e.hooks.list(a.tenantId,r)).hooks||[]).filter(M);if(o.length===0)return i;let s=new Set((i.hooks||[]).map(e=>e.hook_id)),c=o.filter(e=>!s.has(e.hook_id));return{...i,hooks:[...i.hooks||[],...c],length:typeof i.length==`number`?i.length+c.length:i.length}},get:async(n,r)=>{let i=await e.hooks.get(n,r);if(i)return i;let a=await t(n);if(!a||n===a.tenantId)return i;let o=await e.hooks.get(a.tenantId,r);return o&&M(o)?o:null}}}function P(e,t){return j(e,t)}function F(e){return async(t,n)=>{let r=t.var.user;return r?.tenant_id===e&&r.org_name&&t.set(`tenant_id`,r.org_name),n()}}function I(e){return async(n,r)=>{if(!e.accessControl)return r();let{controlPlaneTenantId:a}=e.accessControl,o=n.var.org_name,s=n.var.organization_id,c=o||s,l=n.var.tenant_id,u=n.var.user,d=(u?.aud?Array.isArray(u.aud)?u.aud:[u.aud]:[]).includes(t.MANAGEMENT_API_AUDIENCE);if(!l&&c&&d&&(n.set(`tenant_id`,c),l=c),!l)throw new _(400,{message:`Tenant ID not found in request`});if(!i(s,l,a,o))throw new _(403,{message:`Access denied to tenant ${l}`});return r()}}function L(e){return async(t,n)=>{if(!e.subdomainRouting)return n();let{baseDomain:r,reservedSubdomains:i=[],resolveSubdomain:a}=e.subdomainRouting,o=t.req.header(`x-forwarded-host`)||t.req.header(`host`)||``,s=null;if(o.endsWith(r)){let e=o.slice(0,-(r.length+1));e&&!e.includes(`.`)&&(s=e)}if(s&&i.includes(s)&&(s=null),!s)return e.accessControl&&t.set(`tenant_id`,e.accessControl.controlPlaneTenantId),n();let c=null;if(a)c=await a(s);else if(e.subdomainRouting.useOrganizations!==!1&&e.accessControl)try{let n=await t.env.data.organizations.get(e.accessControl.controlPlaneTenantId,s);n&&(c=n.id)}catch{}if(!c)throw new _(404,{message:`Tenant not found for subdomain: ${s}`});return t.set(`tenant_id`,c),n()}}function R(e){return async(t,n)=>{if(!e.databaseIsolation)return n();let r=t.var.tenant_id;if(!r)throw new _(400,{message:`Tenant ID not found in request`});try{let n=await e.databaseIsolation.getAdapters(r);t.env.data=n}catch(e){throw console.error(`Failed to resolve database for tenant ${r}:`,e),new _(500,{message:`Failed to resolve tenant database`})}return n()}}function z(e){let t=L(e),n=I(e),r=R(e);return async(e,i)=>(await t(e,async()=>{}),await n(e,async()=>{}),await r(e,async()=>{}),i())}function B(e){let{dataAdapter:n,controlPlane:r,controlPlane:{tenantId:i=`control_plane`,clientId:a}={},resolveControlPlane:o,sync:c={resourceServers:!0,roles:!0},defaultPermissions:l=[`tenant:admin`],requireOrganizationMatch:u=!1,managementApiExtensions:d=[],entityHooks:f,getChildTenantIds:p,getAdapters:m,...h}=e;if(o&&!r)throw Error("initMultiTenant: `resolveControlPlane` requires `controlPlane` to be set. The static `controlPlane.tenantId` is used for access control, sync direction, and tenant management routing; the resolver only overrides per-tenant runtime inheritance lookups on top of it.");let _=n,y=n;r&&(_=P(n,{controlPlaneTenantId:i,controlPlaneClientId:a,resolveControlPlane:o}),y={...A(n,{controlPlaneTenantId:i,resolveControlPlane:o}),multiTenancyConfig:{controlPlaneTenantId:i,controlPlaneClientId:a,resolveControlPlane:o}});let b=c!==!1,x=b?{resourceServers:c.resourceServers??!0,roles:c.roles??!0}:{resourceServers:!1,roles:!1},{entityHooks:C,tenantHooks:w}=g({controlPlaneTenantId:i,getChildTenantIds:p??(async()=>(await(0,t.fetchAll)(e=>_.tenants.list(e),`tenants`,{cursorField:`id`,pageSize:100})).filter(e=>e.id!==i).map(e=>e.id)),getAdapters:m??(async()=>_),getControlPlaneAdapters:async()=>_,sync:x}),T={resourceServers:[C.resourceServers,...f?.resourceServers??[]],roles:[C.roles,...f?.roles??[]],connections:f?.connections??[],tenants:f?.tenants??[],rolePermissions:f?.rolePermissions??[]},E=s({accessControl:{controlPlaneTenantId:i,requireOrganizationMatch:u,defaultPermissions:l}}),D=v({accessControl:{controlPlaneTenantId:i,requireOrganizationMatch:u,defaultPermissions:l}},{tenants:{async beforeCreate(e,t){return E.beforeCreate&&(t=await E.beforeCreate(e,t)),w.beforeCreate&&(t=await w.beforeCreate(e,t)),t},async afterCreate(e,t){await E.afterCreate?.(e,t),await w.afterCreate?.(e,t)},async beforeDelete(e,t){await E.beforeDelete?.(e,t),await w.beforeDelete?.(e,t)}}}),{app:O}=(0,t.init)({dataAdapter:_,managementDataAdapter:y,...h,entityHooks:T,managementApiExtensions:[...d,{path:`/tenants`,router:D}]});return O.use(`/api/v2/*`,F(i)),b&&O.use(`/api/v2/*`,S()),{app:O,controlPlaneTenantId:i}}function V(e){let t=H(e);return{name:`multi-tenancy`,middleware:z(e),hooks:t,routes:[{path:`/management`,handler:v(e,t)}],onRegister:async()=>{console.log(`Multi-tenancy plugin registered`),e.accessControl&&console.log(`  - Access control enabled (control plane: ${e.accessControl.controlPlaneTenantId})`),e.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${e.subdomainRouting.baseDomain})`),e.databaseIsolation&&console.log(`  - Database isolation enabled`)}}}function H(e){let t=e.accessControl?r(e.accessControl):{},n=e.databaseIsolation?a(e.databaseIsolation):{},i=s(e);return{...t,...n,tenants:i}}function U(t){let n=new e.Hono,r=H(t);return n.route(`/tenants`,v(t,r)),n}function W(e){return{hooks:H(e),middleware:z(e),app:U(e),config:e,wrapAdapters:(t,n)=>P(t,{controlPlaneTenantId:e.accessControl?.controlPlaneTenantId,controlPlaneClientId:n?.controlPlaneClientId})}}exports.createAccessControlHooks=r,exports.createAccessControlMiddleware=I,exports.createControlPlaneTenantMiddleware=F,exports.createDatabaseHooks=a,exports.createDatabaseMiddleware=R,exports.createMultiTenancy=U,exports.createMultiTenancyHooks=H,exports.createMultiTenancyMiddleware=z,exports.createMultiTenancyPlugin=V,exports.createProtectSyncedMiddleware=S,exports.createProvisioningHooks=s,exports.createRuntimeFallbackAdapter=j,exports.createSubdomainMiddleware=L,exports.createSyncHooks=g,exports.createTenantsOpenAPIRouter=v,exports.initMultiTenant=B,exports.mergeClientWithFallback=D,exports.setupMultiTenancy=W,exports.validateTenantAccess=i,exports.withRuntimeFallback=P,exports.withSystemResourceServerInheritance=A;