@authhero/multi-tenancy 14.3.0 → 14.4.0

package/dist/multi-tenancy.cjs

@@ -1 +1 @@
-"use strict";var x=Object.defineProperty;var ee=(t,e,n)=>e in t?x(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var R=(t,e,n)=>ee(t,typeof e!="symbol"?e+"":e,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const te=require("hono"),v=require("authhero"),b=require("@hono/zod-openapi");function H(t){const{controlPlaneTenantId:e,requireOrganizationMatch:n=!0}=t;return{async onTenantAccessValidation(a,r){if(r===e)return!0;if(n){const i=a.var.org_name,o=a.var.organization_id,s=i||o;return s?s.toLowerCase()===r.toLowerCase():!1}return!0}}}function G(t,e,n,a){if(e===n)return!0;const r=a||t;return r?r.toLowerCase()===e.toLowerCase():!1}function U(t){return{async resolveDataAdapters(e){try{return await t.getAdapters(e)}catch(n){console.error(`Failed to resolve data adapters for tenant ${e}:`,n);return}}}}function ne(t){return`urn:authhero:tenant:${t.toLowerCase()}`}function L(t){return{async beforeCreate(e,n){return!n.audience&&n.id?{...n,audience:ne(n.id)}:n},async afterCreate(e,n){const{accessControl:a,databaseIsolation:r}=t;a&&e.ctx&&await ae(e,n,a),r!=null&&r.onProvision&&await r.onProvision(n.id)},async beforeDelete(e,n){const{accessControl:a,databaseIsolation:r}=t;if(a)try{const o=(await e.adapters.organizations.list(a.controlPlaneTenantId)).organizations.find(s=>s.name===n);o&&await e.adapters.organizations.remove(a.controlPlaneTenantId,o.id)}catch(i){console.warn(`Failed to remove organization for tenant ${n}:`,i)}if(r!=null&&r.onDeprovision)try{await r.onDeprovision(n)}catch(i){console.warn(`Failed to deprovision database for tenant ${n}:`,i)}}}}async function ae(t,e,n){const{controlPlaneTenantId:a,defaultPermissions:r,defaultRoles:i,issuer:o,adminRoleName:s="Tenant Admin",adminRoleDescription:c="Full access to all tenant management operations",addCreatorToOrganization:m=!0}=n,l=await t.adapters.organizations.create(a,{name:e.id,display_name:e.friendly_name||e.id});let f;if(o&&(f=await re(t,a,s,c)),m&&t.ctx){const d=t.ctx.var.user;if(d!=null&&d.sub&&!await se(t,a,d.sub))try{await t.adapters.userOrganizations.create(a,{user_id:d.sub,organization_id:l.id}),f&&await t.adapters.userRoles.create(a,d.sub,f,l.id)}catch(p){console.warn(`Failed to add creator ${d.sub} to organization ${l.id}:`,p)}}i&&i.length>0&&console.log(`Would assign roles ${i.join(", ")} to organization ${l.id}`),r&&r.length>0&&console.log(`Would grant permissions ${r.join(", ")} to organization ${l.id}`)}async function se(t,e,n){const a=await t.adapters.userRoles.list(e,n,void 0,"");for(const r of a)if((await t.adapters.rolePermissions.list(e,r.id,{per_page:1e3})).some(s=>s.permission_name==="admin:organizations"))return!0;return!1}async function re(t,e,n,a){const i=(await t.adapters.roles.list(e,{})).roles.find(m=>m.name===n);if(i)return i.id;const o=await t.adapters.roles.create(e,{name:n,description:a}),s=v.MANAGEMENT_API_AUDIENCE,c=v.MANAGEMENT_API_SCOPES.map(m=>({role_id:o.id,resource_server_identifier:s,permission_name:m.value}));return await t.adapters.rolePermissions.assign(e,o.id,c),o.id}function k(t,e,n=()=>!0){const{controlPlaneTenantId:a,getChildTenantIds:r,getAdapters:i}=t,o=new Map;async function s(l,f,d){return(await e(l).list(f,{q:`name:${d}`,per_page:1}))[0]??null}async function c(l){const f=await r(),d=e(await i(a));await Promise.all(f.map(async u=>{try{const p=await i(u),g=e(p),w={...d.transform(l),is_system:!0},S=await s(p,u,l.name),T=S?g.getId(S):void 0;if(S&&T){const h=g.preserveOnUpdate?g.preserveOnUpdate(S,w):w;await g.update(u,T,h)}else await g.create(u,w)}catch(p){console.error(`Failed to sync ${d.listKey} "${l.name}" to tenant "${u}":`,p)}}))}async function m(l){const f=await r();await Promise.all(f.map(async d=>{try{const u=await i(d),p=e(u),g=await s(u,d,l),y=g?p.getId(g):void 0;g&&y&&await p.remove(d,y)}catch(u){console.error(`Failed to delete entity "${l}" from tenant "${d}":`,u)}}))}return{afterCreate:async(l,f)=>{l.tenantId===a&&n(f)&&await c(f)},afterUpdate:async(l,f,d)=>{l.tenantId===a&&n(d)&&await c(d)},beforeDelete:async(l,f)=>{if(l.tenantId!==a)return;const u=await e(l.adapters).get(l.tenantId,f);u&&n(u)&&o.set(f,u)},afterDelete:async(l,f)=>{if(l.tenantId!==a)return;const d=o.get(f);d&&(o.delete(f),await m(d.name))}}}function j(t,e,n=()=>!0){const{controlPlaneTenantId:a,getControlPlaneAdapters:r,getAdapters:i}=t;return{async afterCreate(o,s){if(s.id!==a)try{const c=await r(),m=await i(s.id),l=e(c),f=e(m),d=await v.fetchAll(u=>l.listPaginated(a,u),l.listKey,{cursorField:"id",pageSize:100});await Promise.all(d.filter(u=>n(u)).map(async u=>{try{const p=l.transform(u);await f.create(s.id,{...p,is_system:!0})}catch(p){console.error(`Failed to sync entity to new tenant "${s.id}":`,p)}}))}catch(c){console.error(`Failed to sync entities to new tenant "${s.id}":`,c)}}}}const E=t=>({list:async(e,n)=>(await t.resourceServers.list(e,n)).resource_servers,listPaginated:(e,n)=>t.resourceServers.list(e,n),get:(e,n)=>t.resourceServers.get(e,n),create:(e,n)=>t.resourceServers.create(e,n),update:(e,n,a)=>t.resourceServers.update(e,n,a),remove:(e,n)=>t.resourceServers.remove(e,n),listKey:"resource_servers",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,identifier:e.identifier,scopes:e.scopes,signing_alg:e.signing_alg,token_lifetime:e.token_lifetime,token_lifetime_for_web:e.token_lifetime_for_web})}),N=t=>({list:async(e,n)=>(await t.roles.list(e,n)).roles,listPaginated:(e,n)=>t.roles.list(e,n),get:(e,n)=>t.roles.get(e,n),create:(e,n)=>t.roles.create(e,n),update:(e,n,a)=>t.roles.update(e,n,a),remove:(e,n)=>t.roles.remove(e,n),listKey:"roles",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,description:e.description})});function B(t){const{sync:e={},filters:n={}}=t,a=e.resourceServers??!0,r=e.roles??!0,i=a?k(t,E,n.resourceServers):void 0,o=r?k(t,N,n.roles):void 0,s=a?j(t,E,n.resourceServers):void 0,c=r?j(t,N,n.roles):void 0,m=r?{async afterCreate(d,u){var p;if(u.id!==t.controlPlaneTenantId){await((p=c==null?void 0:c.afterCreate)==null?void 0:p.call(c,d,u));try{const g=await t.getControlPlaneAdapters(),y=await t.getAdapters(u.id),w=await v.fetchAll(T=>g.roles.list(t.controlPlaneTenantId,T),"roles",{cursorField:"id",pageSize:100}),S=new Map;for(const T of w.filter(h=>{var _;return((_=n.roles)==null?void 0:_.call(n,h))??!0})){const h=await l(y,u.id,T.name);h&&S.set(T.name,h.id)}for(const T of w.filter(h=>{var _;return((_=n.roles)==null?void 0:_.call(n,h))??!0})){const h=S.get(T.name);if(h)try{const _=await g.rolePermissions.list(t.controlPlaneTenantId,T.id,{});_.length>0&&await y.rolePermissions.assign(u.id,h,_.map(A=>({role_id:h,resource_server_identifier:A.resource_server_identifier,permission_name:A.permission_name})))}catch(_){console.error(`Failed to sync permissions for role "${T.name}" to tenant "${u.id}":`,_)}}}catch(g){console.error(`Failed to sync role permissions to tenant "${u.id}":`,g)}}}}:void 0;async function l(d,u,p){return(await d.roles.list(u,{q:`name:${p}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:i,roles:o},tenantHooks:{async afterCreate(d,u){const p=[s==null?void 0:s.afterCreate,(m==null?void 0:m.afterCreate)??(c==null?void 0:c.afterCreate)],g=[];for(const y of p)if(y)try{await y(d,u)}catch(w){g.push(w instanceof Error?w:new Error(String(w)))}if(g.length===1)throw g[0];if(g.length>1)throw new AggregateError(g,g.map(y=>y.message).join("; "))}}}}var C=class extends Error{constructor(e=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});R(this,"res");R(this,"status");this.res=n==null?void 0:n.res,this.status=e}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function M(t,e){const n=new b.OpenAPIHono;return n.openapi(b.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:v.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:b.z.object({tenants:b.z.array(v.tenantSchema),start:b.z.number().optional(),limit:b.z.number().optional(),length:b.z.number().optional()})}},description:"List of tenants"}}}),async a=>{var u,p,g,y;const r=a.req.valid("query"),{page:i,per_page:o,include_totals:s,q:c}=r,m=a.var.user,l=(m==null?void 0:m.permissions)||[];if(l.includes("auth:read")||l.includes("admin:organizations")){const w=await a.env.data.tenants.list({page:i,per_page:o,include_totals:s,q:c});return s?a.json({tenants:w.tenants,start:((u=w.totals)==null?void 0:u.start)??0,limit:((p=w.totals)==null?void 0:p.limit)??o,length:w.tenants.length}):a.json({tenants:w.tenants})}if(t.accessControl&&(m!=null&&m.sub)){const w=t.accessControl.controlPlaneTenantId,T=(await v.fetchAll(P=>a.env.data.userOrganizations.listUserOrganizations(w,m.sub,P),"organizations")).map(P=>P.name);if(T.length===0)return s?a.json({tenants:[],start:0,limit:o??50,length:0}):a.json({tenants:[]});const h=T.length,_=i??0,A=o??50,I=_*A,q=T.slice(I,I+A);if(q.length===0)return s?a.json({tenants:[],start:I,limit:A,length:h}):a.json({tenants:[]});const D=q.map(P=>`id:${P}`).join(" OR "),Z=c?`(${D}) AND (${c})`:D,F=await a.env.data.tenants.list({q:Z,per_page:A,include_totals:!1});return s?a.json({tenants:F.tenants,start:I,limit:A,length:h}):a.json({tenants:F.tenants})}const d=await a.env.data.tenants.list({page:i,per_page:o,include_totals:s,q:c});return s?a.json({tenants:d.tenants,start:((g=d.totals)==null?void 0:g.start)??0,limit:((y=d.totals)==null?void 0:y.limit)??o,length:d.tenants.length}):a.json({tenants:d.tenants})}),n.openapi(b.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:v.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:v.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async a=>{var c,m;const r=a.var.user;if(!(r!=null&&r.sub))throw new C(401,{message:"Authentication required to create tenants"});let i=a.req.valid("json");const o={adapters:a.env.data,ctx:a};(c=e.tenants)!=null&&c.beforeCreate&&(i=await e.tenants.beforeCreate(o,i));const s=await a.env.data.tenants.create(i);return(m=e.tenants)!=null&&m.afterCreate&&await e.tenants.afterCreate(o,s),a.json(s,201)}),n.openapi(b.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:b.z.object({id:b.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async a=>{var s,c;const{id:r}=a.req.valid("param");if(t.accessControl){const m=a.var.user,l=t.accessControl.controlPlaneTenantId;if(!(m!=null&&m.sub))throw new C(401,{message:"Authentication required"});if(r===l)throw new C(403,{message:"Cannot delete the control plane"});if(!(await v.fetchAll(u=>a.env.data.userOrganizations.listUserOrganizations(l,m.sub,u),"organizations")).some(u=>u.name===r))throw new C(403,{message:"Access denied to this tenant"})}if(!await a.env.data.tenants.get(r))throw new C(404,{message:"Tenant not found"});const o={adapters:a.env.data,ctx:a};return(s=e.tenants)!=null&&s.beforeDelete&&await e.tenants.beforeDelete(o,r),await a.env.data.tenants.remove(r),(c=e.tenants)!=null&&c.afterDelete&&await e.tenants.afterDelete(o,r),a.body(null,204)}),n}function oe(t){const e=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:a}of e){const r=t.match(n);if(r&&r[1])return{type:a,id:r[1]}}return null}async function ie(t,e,n){try{switch(n.type){case"resource_server":{const a=await t.resourceServers.get(e,n.id);return(a==null?void 0:a.is_system)===!0}case"role":{const a=await t.roles.get(e,n.id);return(a==null?void 0:a.is_system)===!0}case"connection":{const a=await t.connections.get(e,n.id);return(a==null?void 0:a.is_system)===!0}default:return!1}}catch{return!1}}function ce(t){return{resource_server:"resource server",role:"role",connection:"connection"}[t]}function K(){return async(t,e)=>{if(!["PATCH","PUT","DELETE"].includes(t.req.method))return e();const n=oe(t.req.path);if(!n)return e();const a=t.var.tenant_id||t.req.header("x-tenant-id")||t.req.header("tenant-id");if(!a)return e();if(await ie(t.env.data,a,n))throw new C(403,{message:`This ${ce(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return e()}}function $(t,e){const{controlPlaneTenantId:n,controlPlaneClientId:a}=e;return{...t,legacyClients:{...t.legacyClients,get:async r=>{var f;const i=await t.legacyClients.get(r);if(!i)return null;const o=a?await t.legacyClients.get(a):void 0,s=await t.connections.list(i.tenant.id),c=n?await t.connections.list(n):{connections:[]},m=s.connections.map(d=>{var g;const u=(g=c.connections)==null?void 0:g.find(y=>y.strategy===d.strategy);if(!(u!=null&&u.options))return d;const p=v.connectionSchema.parse({...u||{},...d});return p.options=v.connectionOptionsSchema.parse({...u.options||{},...d.options}),p}).filter(d=>d),l={...(o==null?void 0:o.tenant)||{},...i.tenant};return!i.tenant.audience&&((f=o==null?void 0:o.tenant)!=null&&f.audience)&&(l.audience=o.tenant.audience),{...i,web_origins:[...(o==null?void 0:o.web_origins)||[],...i.web_origins||[]],allowed_logout_urls:[...(o==null?void 0:o.allowed_logout_urls)||[],...i.allowed_logout_urls||[]],callbacks:[...(o==null?void 0:o.callbacks)||[],...i.callbacks||[]],connections:m,tenant:l}}},connections:{...t.connections,get:async(r,i)=>{var l;const o=await t.connections.get(r,i);if(!o||!n||r===n)return o;const c=(l=(await t.connections.list(n)).connections)==null?void 0:l.find(f=>f.strategy===o.strategy);if(!(c!=null&&c.options))return o;const m=v.connectionSchema.parse({...c,...o});return m.options=v.connectionOptionsSchema.parse({...c.options||{},...o.options}),m},list:async(r,i)=>{const o=await t.connections.list(r,i);if(!n||r===n)return o;const s=await t.connections.list(n),c=o.connections.map(m=>{var d;const l=(d=s.connections)==null?void 0:d.find(u=>u.strategy===m.strategy);if(!(l!=null&&l.options))return m;const f=v.connectionSchema.parse({...l,...m});return f.options=v.connectionOptionsSchema.parse({...l.options||{},...m.options}),f});return{...o,connections:c}}}}}function W(t,e){return $(t,e)}const le=$,de=W;function Q(t){return async(e,n)=>{const a=e.var.user;return(a==null?void 0:a.tenant_id)===t&&a.org_name&&e.set("tenant_id",a.org_name),n()}}function V(t){return async(e,n)=>{if(!t.accessControl)return n();const{controlPlaneTenantId:a}=t.accessControl,r=e.var.org_name,i=e.var.organization_id,o=r||i;let s=e.var.tenant_id;const c=e.var.user,l=(c!=null&&c.aud?Array.isArray(c.aud)?c.aud:[c.aud]:[]).includes(v.MANAGEMENT_API_AUDIENCE);if(!s&&o&&l&&(e.set("tenant_id",o),s=o),!s)throw new C(400,{message:"Tenant ID not found in request"});if(!G(i,s,a,r))throw new C(403,{message:`Access denied to tenant ${s}`});return n()}}function J(t){return async(e,n)=>{if(!t.subdomainRouting)return n();const{baseDomain:a,reservedSubdomains:r=[],resolveSubdomain:i}=t.subdomainRouting,o=e.req.header("host")||"";let s=null;if(o.endsWith(a)){const m=o.slice(0,-(a.length+1));m&&!m.includes(".")&&(s=m)}if(s&&r.includes(s)&&(s=null),!s)return t.accessControl&&e.set("tenant_id",t.accessControl.controlPlaneTenantId),n();let c=null;if(i)c=await i(s);else if(t.subdomainRouting.useOrganizations!==!1&&t.accessControl)try{const m=await e.env.data.organizations.get(t.accessControl.controlPlaneTenantId,s);m&&(c=m.id)}catch{}if(!c)throw new C(404,{message:`Tenant not found for subdomain: ${s}`});return e.set("tenant_id",c),n()}}function X(t){return async(e,n)=>{if(!t.databaseIsolation)return n();const a=e.var.tenant_id;if(!a)throw new C(400,{message:"Tenant ID not found in request"});try{const r=await t.databaseIsolation.getAdapters(a);e.env.data=r}catch(r){throw console.error(`Failed to resolve database for tenant ${a}:`,r),new C(500,{message:"Failed to resolve tenant database"})}return n()}}function O(t){const e=J(t),n=V(t),a=X(t);return async(r,i)=>(await e(r,async()=>{}),await n(r,async()=>{}),await a(r,async()=>{}),i())}function ue(t){const{dataAdapter:e,controlPlaneTenantId:n="control_plane",sync:a={resourceServers:!0,roles:!0},defaultPermissions:r=["tenant:admin"],requireOrganizationMatch:i=!1,managementApiExtensions:o=[],entityHooks:s,getChildTenantIds:c,getAdapters:m,...l}=t,f=a!==!1,d=f?{resourceServers:a.resourceServers??!0,roles:a.roles??!0}:{resourceServers:!1,roles:!1},g={controlPlaneTenantId:n,getChildTenantIds:c??(async()=>(await v.fetchAll(A=>e.tenants.list(A),"tenants",{cursorField:"id",pageSize:100})).filter(A=>A.id!==n).map(A=>A.id)),getAdapters:m??(async()=>e),getControlPlaneAdapters:async()=>e,sync:d},{entityHooks:y,tenantHooks:w}=B(g),S={resourceServers:[y.resourceServers,...(s==null?void 0:s.resourceServers)??[]],roles:[y.roles,...(s==null?void 0:s.roles)??[]],connections:(s==null?void 0:s.connections)??[],tenants:(s==null?void 0:s.tenants)??[],rolePermissions:(s==null?void 0:s.rolePermissions)??[]},T=M({accessControl:{controlPlaneTenantId:n,requireOrganizationMatch:i,defaultPermissions:r}},{tenants:w}),{app:h}=v.init({dataAdapter:e,...l,entityHooks:S,managementApiExtensions:[...o,{path:"/tenants",router:T}]});return h.use("/api/v2/*",Q(n)),f&&h.use("/api/v2/*",K()),{app:h,controlPlaneTenantId:n}}function me(t){const e=z(t);return{name:"multi-tenancy",middleware:O(t),hooks:e,routes:[{path:"/management",handler:M(t,e)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),t.accessControl&&console.log(`  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`),t.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`),t.databaseIsolation&&console.log("  - Database isolation enabled")}}}function z(t){const e=t.accessControl?H(t.accessControl):{},n=t.databaseIsolation?U(t.databaseIsolation):{},a=L(t);return{...e,...n,tenants:a}}function Y(t){const e=new te.Hono,n=z(t);return e.route("/tenants",M(t,n)),e}function fe(t){return{hooks:z(t),middleware:O(t),app:Y(t),config:t}}exports.createAccessControlHooks=H;exports.createAccessControlMiddleware=V;exports.createControlPlaneTenantMiddleware=Q;exports.createDatabaseHooks=U;exports.createDatabaseMiddleware=X;exports.createMultiTenancy=Y;exports.createMultiTenancyHooks=z;exports.createMultiTenancyMiddleware=O;exports.createMultiTenancyPlugin=me;exports.createProtectSyncedMiddleware=K;exports.createProvisioningHooks=L;exports.createRuntimeFallbackAdapter=$;exports.createSettingsInheritanceAdapter=le;exports.createSubdomainMiddleware=J;exports.createSyncHooks=B;exports.createTenantsOpenAPIRouter=M;exports.initMultiTenant=ue;exports.setupMultiTenancy=fe;exports.validateTenantAccess=G;exports.withRuntimeFallback=W;exports.withSettingsInheritance=de;
+"use strict";var ee=Object.defineProperty;var te=(t,e,n)=>e in t?ee(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var $=(t,e,n)=>te(t,typeof e!="symbol"?e+"":e,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const ne=require("hono"),h=require("authhero"),S=require("@hono/zod-openapi");function G(t){const{controlPlaneTenantId:e,requireOrganizationMatch:n=!0}=t;return{async onTenantAccessValidation(a,r){if(r===e)return!0;if(n){const c=a.var.org_name,o=a.var.organization_id,s=c||o;return s?s.toLowerCase()===r.toLowerCase():!1}return!0}}}function U(t,e,n,a){if(e===n)return!0;const r=a||t;return r?r.toLowerCase()===e.toLowerCase():!1}function L(t){return{async resolveDataAdapters(e){try{return await t.getAdapters(e)}catch(n){console.error(`Failed to resolve data adapters for tenant ${e}:`,n);return}}}}function ae(t){return`urn:authhero:tenant:${t.toLowerCase()}`}function B(t){return{async beforeCreate(e,n){return!n.audience&&n.id?{...n,audience:ae(n.id)}:n},async afterCreate(e,n){const{accessControl:a,databaseIsolation:r}=t;a&&e.ctx&&await re(e,n,a),r!=null&&r.onProvision&&await r.onProvision(n.id)},async beforeDelete(e,n){const{accessControl:a,databaseIsolation:r}=t;if(a)try{const o=(await e.adapters.organizations.list(a.controlPlaneTenantId)).organizations.find(s=>s.name===n);o&&await e.adapters.organizations.remove(a.controlPlaneTenantId,o.id)}catch(c){console.warn(`Failed to remove organization for tenant ${n}:`,c)}if(r!=null&&r.onDeprovision)try{await r.onDeprovision(n)}catch(c){console.warn(`Failed to deprovision database for tenant ${n}:`,c)}}}}async function re(t,e,n){const{controlPlaneTenantId:a,defaultPermissions:r,defaultRoles:c,issuer:o,adminRoleName:s="Tenant Admin",adminRoleDescription:d="Full access to all tenant management operations",addCreatorToOrganization:l=!0}=n,i=await t.adapters.organizations.create(a,{name:e.id,display_name:e.friendly_name||e.id});let f;if(o&&(f=await oe(t,a,s,d)),l&&t.ctx){const u=t.ctx.var.user;if(u!=null&&u.sub&&!await se(t,a,u.sub))try{await t.adapters.userOrganizations.create(a,{user_id:u.sub,organization_id:i.id}),f&&await t.adapters.userRoles.create(a,u.sub,f,i.id)}catch(g){console.warn(`Failed to add creator ${u.sub} to organization ${i.id}:`,g)}}c&&c.length>0&&console.log(`Would assign roles ${c.join(", ")} to organization ${i.id}`),r&&r.length>0&&console.log(`Would grant permissions ${r.join(", ")} to organization ${i.id}`)}async function se(t,e,n){const a=await t.adapters.userRoles.list(e,n,void 0,"");for(const r of a)if((await t.adapters.rolePermissions.list(e,r.id,{per_page:1e3})).some(s=>s.permission_name==="admin:organizations"))return!0;return!1}async function oe(t,e,n,a){const c=(await t.adapters.roles.list(e,{})).roles.find(l=>l.name===n);if(c)return c.id;const o=await t.adapters.roles.create(e,{name:n,description:a}),s=h.MANAGEMENT_API_AUDIENCE,d=h.MANAGEMENT_API_SCOPES.map(l=>({role_id:o.id,resource_server_identifier:s,permission_name:l.value}));return await t.adapters.rolePermissions.assign(e,o.id,d),o.id}function k(t,e,n=()=>!0){const{controlPlaneTenantId:a,getChildTenantIds:r,getAdapters:c}=t,o=new Map;async function s(i,f,u){return(await e(i).list(f,{q:`name:${u}`,per_page:1}))[0]??null}async function d(i){const f=await r(),u=e(await c(a));await Promise.all(f.map(async m=>{try{const g=await c(m),p=e(g),w={...u.transform(i),is_system:!0},T=await s(g,m,i.name),A=T?p.getId(T):void 0;if(T&&A){const b=p.preserveOnUpdate?p.preserveOnUpdate(T,w):w;await p.update(m,A,b)}else await p.create(m,w)}catch(g){console.error(`Failed to sync ${u.listKey} "${i.name}" to tenant "${m}":`,g)}}))}async function l(i){const f=await r();await Promise.all(f.map(async u=>{try{const m=await c(u),g=e(m),p=await s(m,u,i),v=p?g.getId(p):void 0;p&&v&&await g.remove(u,v)}catch(m){console.error(`Failed to delete entity "${i}" from tenant "${u}":`,m)}}))}return{afterCreate:async(i,f)=>{i.tenantId===a&&n(f)&&await d(f)},afterUpdate:async(i,f,u)=>{i.tenantId===a&&n(u)&&await d(u)},beforeDelete:async(i,f)=>{if(i.tenantId!==a)return;const m=await e(i.adapters).get(i.tenantId,f);m&&n(m)&&o.set(f,m)},afterDelete:async(i,f)=>{if(i.tenantId!==a)return;const u=o.get(f);u&&(o.delete(f),await l(u.name))}}}function j(t,e,n=()=>!0){const{controlPlaneTenantId:a,getControlPlaneAdapters:r,getAdapters:c}=t;return{async afterCreate(o,s){if(s.id!==a)try{const d=await r(),l=await c(s.id),i=e(d),f=e(l),u=await h.fetchAll(m=>i.listPaginated(a,m),i.listKey,{cursorField:"id",pageSize:100});await Promise.all(u.filter(m=>n(m)).map(async m=>{try{const g=i.transform(m);await f.create(s.id,{...g,is_system:!0})}catch(g){console.error(`Failed to sync entity to new tenant "${s.id}":`,g)}}))}catch(d){console.error(`Failed to sync entities to new tenant "${s.id}":`,d)}}}}const E=t=>({list:async(e,n)=>(await t.resourceServers.list(e,n)).resource_servers,listPaginated:(e,n)=>t.resourceServers.list(e,n),get:(e,n)=>t.resourceServers.get(e,n),create:(e,n)=>t.resourceServers.create(e,n),update:(e,n,a)=>t.resourceServers.update(e,n,a),remove:(e,n)=>t.resourceServers.remove(e,n),listKey:"resource_servers",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,identifier:e.identifier,scopes:e.scopes,signing_alg:e.signing_alg,token_lifetime:e.token_lifetime,token_lifetime_for_web:e.token_lifetime_for_web})}),N=t=>({list:async(e,n)=>(await t.roles.list(e,n)).roles,listPaginated:(e,n)=>t.roles.list(e,n),get:(e,n)=>t.roles.get(e,n),create:(e,n)=>t.roles.create(e,n),update:(e,n,a)=>t.roles.update(e,n,a),remove:(e,n)=>t.roles.remove(e,n),listKey:"roles",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,description:e.description})});function H(t){var e;return((e=t.metadata)==null?void 0:e.sync)!==!1}function K(t){const{sync:e={},filters:n={}}=t,a=e.resourceServers??!0,r=e.roles??!0,c=g=>H(g)?n.resourceServers?n.resourceServers(g):!0:!1,o=g=>H(g)?n.roles?n.roles(g):!0:!1,s=a?k(t,E,c):void 0,d=r?k(t,N,o):void 0,l=a?j(t,E,c):void 0,i=r?j(t,N,o):void 0,f=r?{async afterCreate(g,p){var v;if(p.id!==t.controlPlaneTenantId){await((v=i==null?void 0:i.afterCreate)==null?void 0:v.call(i,g,p));try{const w=await t.getControlPlaneAdapters(),T=await t.getAdapters(p.id),A=await h.fetchAll(C=>w.roles.list(t.controlPlaneTenantId,C),"roles",{cursorField:"id",pageSize:100}),b=new Map;for(const C of A.filter(y=>{var _;return((_=n.roles)==null?void 0:_.call(n,y))??!0})){const y=await u(T,p.id,C.name);y&&b.set(C.name,y.id)}for(const C of A.filter(y=>{var _;return((_=n.roles)==null?void 0:_.call(n,y))??!0})){const y=b.get(C.name);if(y)try{const _=await w.rolePermissions.list(t.controlPlaneTenantId,C.id,{});_.length>0&&await T.rolePermissions.assign(p.id,y,_.map(I=>({role_id:y,resource_server_identifier:I.resource_server_identifier,permission_name:I.permission_name})))}catch(_){console.error(`Failed to sync permissions for role "${C.name}" to tenant "${p.id}":`,_)}}}catch(w){console.error(`Failed to sync role permissions to tenant "${p.id}":`,w)}}}}:void 0;async function u(g,p,v){return(await g.roles.list(p,{q:`name:${v}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:s,roles:d},tenantHooks:{async afterCreate(g,p){const v=[l==null?void 0:l.afterCreate,(f==null?void 0:f.afterCreate)??(i==null?void 0:i.afterCreate)],w=[];for(const T of v)if(T)try{await T(g,p)}catch(A){w.push(A instanceof Error?A:new Error(String(A)))}if(w.length===1)throw w[0];if(w.length>1)throw new AggregateError(w,w.map(T=>T.message).join("; "))}}}}var P=class extends Error{constructor(e=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});$(this,"res");$(this,"status");this.res=n==null?void 0:n.res,this.status=e}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function z(t,e){const n=new S.OpenAPIHono;return n.openapi(S.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:h.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:S.z.object({tenants:S.z.array(h.tenantSchema),start:S.z.number().optional(),limit:S.z.number().optional(),length:S.z.number().optional()})}},description:"List of tenants"}}}),async a=>{var m,g,p,v;const r=a.req.valid("query"),{page:c,per_page:o,include_totals:s,q:d}=r,l=a.var.user,i=(l==null?void 0:l.permissions)||[];if(i.includes("auth:read")||i.includes("admin:organizations")){const w=await a.env.data.tenants.list({page:c,per_page:o,include_totals:s,q:d});return s?a.json({tenants:w.tenants,start:((m=w.totals)==null?void 0:m.start)??0,limit:((g=w.totals)==null?void 0:g.limit)??o,length:w.tenants.length}):a.json({tenants:w.tenants})}if(t.accessControl&&(l!=null&&l.sub)){const w=t.accessControl.controlPlaneTenantId,A=(await h.fetchAll(M=>a.env.data.userOrganizations.listUserOrganizations(w,l.sub,M),"organizations")).map(M=>M.name);if(A.length===0)return s?a.json({tenants:[],start:0,limit:o??50,length:0}):a.json({tenants:[]});const b=A.length,C=c??0,y=o??50,_=C*y,I=A.slice(_,_+y);if(I.length===0)return s?a.json({tenants:[],start:_,limit:y,length:b}):a.json({tenants:[]});const q=I.map(M=>`id:${M}`).join(" OR "),x=d?`(${q}) AND (${d})`:q,D=await a.env.data.tenants.list({q:x,per_page:y,include_totals:!1});return s?a.json({tenants:D.tenants,start:_,limit:y,length:b}):a.json({tenants:D.tenants})}const u=await a.env.data.tenants.list({page:c,per_page:o,include_totals:s,q:d});return s?a.json({tenants:u.tenants,start:((p=u.totals)==null?void 0:p.start)??0,limit:((v=u.totals)==null?void 0:v.limit)??o,length:u.tenants.length}):a.json({tenants:u.tenants})}),n.openapi(S.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:h.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:h.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async a=>{var d,l;const r=a.var.user;if(!(r!=null&&r.sub))throw new P(401,{message:"Authentication required to create tenants"});let c=a.req.valid("json");const o={adapters:a.env.data,ctx:a};(d=e.tenants)!=null&&d.beforeCreate&&(c=await e.tenants.beforeCreate(o,c));const s=await a.env.data.tenants.create(c);return(l=e.tenants)!=null&&l.afterCreate&&await e.tenants.afterCreate(o,s),a.json(s,201)}),n.openapi(S.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:S.z.object({id:S.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async a=>{var s,d;const{id:r}=a.req.valid("param");if(t.accessControl){const l=a.var.user,i=t.accessControl.controlPlaneTenantId;if(!(l!=null&&l.sub))throw new P(401,{message:"Authentication required"});if(r===i)throw new P(403,{message:"Cannot delete the control plane"});if(!(await h.fetchAll(m=>a.env.data.userOrganizations.listUserOrganizations(i,l.sub,m),"organizations")).some(m=>m.name===r))throw new P(403,{message:"Access denied to this tenant"})}if(!await a.env.data.tenants.get(r))throw new P(404,{message:"Tenant not found"});const o={adapters:a.env.data,ctx:a};return(s=e.tenants)!=null&&s.beforeDelete&&await e.tenants.beforeDelete(o,r),await a.env.data.tenants.remove(r),(d=e.tenants)!=null&&d.afterDelete&&await e.tenants.afterDelete(o,r),a.body(null,204)}),n}function ie(t){const e=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:a}of e){const r=t.match(n);if(r&&r[1])return{type:a,id:r[1]}}return null}async function ce(t,e,n){try{switch(n.type){case"resource_server":{const a=await t.resourceServers.get(e,n.id);return(a==null?void 0:a.is_system)===!0}case"role":{const a=await t.roles.get(e,n.id);return(a==null?void 0:a.is_system)===!0}case"connection":{const a=await t.connections.get(e,n.id);return(a==null?void 0:a.is_system)===!0}default:return!1}}catch{return!1}}function le(t){return{resource_server:"resource server",role:"role",connection:"connection"}[t]}function W(){return async(t,e)=>{if(!["PATCH","PUT","DELETE"].includes(t.req.method))return e();const n=ie(t.req.path);if(!n)return e();const a=t.var.tenant_id||t.req.header("x-tenant-id")||t.req.header("tenant-id");if(!a)return e();if(await ce(t.env.data,a,n))throw new P(403,{message:`This ${le(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return e()}}function O(t,e){const{controlPlaneTenantId:n,controlPlaneClientId:a}=e;return{...t,legacyClients:{...t.legacyClients,get:async r=>{var f;const c=await t.legacyClients.get(r);if(!c)return null;const o=a?await t.legacyClients.get(a):void 0,s=await t.connections.list(c.tenant.id),d=n?await t.connections.list(n):{connections:[]},l=s.connections.map(u=>{var p;const m=(p=d.connections)==null?void 0:p.find(v=>v.strategy===u.strategy);if(!(m!=null&&m.options))return u;const g=h.connectionSchema.parse({...m||{},...u});return g.options=h.connectionOptionsSchema.parse({...m.options||{},...u.options}),g}).filter(u=>u),i={...(o==null?void 0:o.tenant)||{},...c.tenant};return!c.tenant.audience&&((f=o==null?void 0:o.tenant)!=null&&f.audience)&&(i.audience=o.tenant.audience),{...c,web_origins:[...(o==null?void 0:o.web_origins)||[],...c.web_origins||[]],allowed_logout_urls:[...(o==null?void 0:o.allowed_logout_urls)||[],...c.allowed_logout_urls||[]],callbacks:[...(o==null?void 0:o.callbacks)||[],...c.callbacks||[]],connections:l,tenant:i}}},connections:{...t.connections,get:async(r,c)=>{var i;const o=await t.connections.get(r,c);if(!o||!n||r===n)return o;const d=(i=(await t.connections.list(n)).connections)==null?void 0:i.find(f=>f.strategy===o.strategy);if(!(d!=null&&d.options))return o;const l=h.connectionSchema.parse({...d,...o});return l.options=h.connectionOptionsSchema.parse({...d.options||{},...o.options}),l},list:async(r,c)=>{const o=await t.connections.list(r,c);if(!n||r===n)return o;const s=await t.connections.list(n),d=o.connections.map(l=>{var u;const i=(u=s.connections)==null?void 0:u.find(m=>m.strategy===l.strategy);if(!(i!=null&&i.options))return l;const f=h.connectionSchema.parse({...i,...l});return f.options=h.connectionOptionsSchema.parse({...i.options||{},...l.options}),f});return{...o,connections:d}}}}}function Q(t,e){return O(t,e)}const de=O,ue=Q;function V(t){return async(e,n)=>{const a=e.var.user;return(a==null?void 0:a.tenant_id)===t&&a.org_name&&e.set("tenant_id",a.org_name),n()}}function J(t){return async(e,n)=>{if(!t.accessControl)return n();const{controlPlaneTenantId:a}=t.accessControl,r=e.var.org_name,c=e.var.organization_id,o=r||c;let s=e.var.tenant_id;const d=e.var.user,i=(d!=null&&d.aud?Array.isArray(d.aud)?d.aud:[d.aud]:[]).includes(h.MANAGEMENT_API_AUDIENCE);if(!s&&o&&i&&(e.set("tenant_id",o),s=o),!s)throw new P(400,{message:"Tenant ID not found in request"});if(!U(c,s,a,r))throw new P(403,{message:`Access denied to tenant ${s}`});return n()}}function X(t){return async(e,n)=>{if(!t.subdomainRouting)return n();const{baseDomain:a,reservedSubdomains:r=[],resolveSubdomain:c}=t.subdomainRouting,o=e.req.header("host")||"";let s=null;if(o.endsWith(a)){const l=o.slice(0,-(a.length+1));l&&!l.includes(".")&&(s=l)}if(s&&r.includes(s)&&(s=null),!s)return t.accessControl&&e.set("tenant_id",t.accessControl.controlPlaneTenantId),n();let d=null;if(c)d=await c(s);else if(t.subdomainRouting.useOrganizations!==!1&&t.accessControl)try{const l=await e.env.data.organizations.get(t.accessControl.controlPlaneTenantId,s);l&&(d=l.id)}catch{}if(!d)throw new P(404,{message:`Tenant not found for subdomain: ${s}`});return e.set("tenant_id",d),n()}}function Y(t){return async(e,n)=>{if(!t.databaseIsolation)return n();const a=e.var.tenant_id;if(!a)throw new P(400,{message:"Tenant ID not found in request"});try{const r=await t.databaseIsolation.getAdapters(a);e.env.data=r}catch(r){throw console.error(`Failed to resolve database for tenant ${a}:`,r),new P(500,{message:"Failed to resolve tenant database"})}return n()}}function F(t){const e=X(t),n=J(t),a=Y(t);return async(r,c)=>(await e(r,async()=>{}),await n(r,async()=>{}),await a(r,async()=>{}),c())}function fe(t){const{dataAdapter:e,controlPlaneTenantId:n="control_plane",sync:a={resourceServers:!0,roles:!0},defaultPermissions:r=["tenant:admin"],requireOrganizationMatch:c=!1,managementApiExtensions:o=[],entityHooks:s,getChildTenantIds:d,getAdapters:l,...i}=t,f=a!==!1,u=f?{resourceServers:a.resourceServers??!0,roles:a.roles??!0}:{resourceServers:!1,roles:!1},p={controlPlaneTenantId:n,getChildTenantIds:d??(async()=>(await h.fetchAll(y=>e.tenants.list(y),"tenants",{cursorField:"id",pageSize:100})).filter(y=>y.id!==n).map(y=>y.id)),getAdapters:l??(async()=>e),getControlPlaneAdapters:async()=>e,sync:u},{entityHooks:v,tenantHooks:w}=K(p),T={resourceServers:[v.resourceServers,...(s==null?void 0:s.resourceServers)??[]],roles:[v.roles,...(s==null?void 0:s.roles)??[]],connections:(s==null?void 0:s.connections)??[],tenants:(s==null?void 0:s.tenants)??[],rolePermissions:(s==null?void 0:s.rolePermissions)??[]},A=z({accessControl:{controlPlaneTenantId:n,requireOrganizationMatch:c,defaultPermissions:r}},{tenants:w}),{app:b}=h.init({dataAdapter:e,...i,entityHooks:T,managementApiExtensions:[...o,{path:"/tenants",router:A}]});return b.use("/api/v2/*",V(n)),f&&b.use("/api/v2/*",W()),{app:b,controlPlaneTenantId:n}}function me(t){const e=R(t);return{name:"multi-tenancy",middleware:F(t),hooks:e,routes:[{path:"/management",handler:z(t,e)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),t.accessControl&&console.log(`  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`),t.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`),t.databaseIsolation&&console.log("  - Database isolation enabled")}}}function R(t){const e=t.accessControl?G(t.accessControl):{},n=t.databaseIsolation?L(t.databaseIsolation):{},a=B(t);return{...e,...n,tenants:a}}function Z(t){const e=new ne.Hono,n=R(t);return e.route("/tenants",z(t,n)),e}function ge(t){return{hooks:R(t),middleware:F(t),app:Z(t),config:t}}exports.createAccessControlHooks=G;exports.createAccessControlMiddleware=J;exports.createControlPlaneTenantMiddleware=V;exports.createDatabaseHooks=L;exports.createDatabaseMiddleware=Y;exports.createMultiTenancy=Z;exports.createMultiTenancyHooks=R;exports.createMultiTenancyMiddleware=F;exports.createMultiTenancyPlugin=me;exports.createProtectSyncedMiddleware=W;exports.createProvisioningHooks=B;exports.createRuntimeFallbackAdapter=O;exports.createSettingsInheritanceAdapter=de;exports.createSubdomainMiddleware=X;exports.createSyncHooks=K;exports.createTenantsOpenAPIRouter=z;exports.initMultiTenant=fe;exports.setupMultiTenancy=ge;exports.validateTenantAccess=U;exports.withRuntimeFallback=Q;exports.withSettingsInheritance=ue;