@authhero/multi-tenancy 14.5.0 → 14.7.0

package/dist/multi-tenancy.cjs

@@ -1 +1 @@
-"use strict";var ne=Object.defineProperty;var ae=(t,e,n)=>e in t?ne(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var F=(t,e,n)=>ae(t,typeof e!="symbol"?e+"":e,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const re=require("hono"),y=require("authhero"),I=require("@hono/zod-openapi");function B(t){const{controlPlaneTenantId:e,requireOrganizationMatch:n=!0}=t;return{async onTenantAccessValidation(a,r){if(r===e)return!0;if(n){const c=a.var.org_name,o=a.var.organization_id,s=c||o;return s?s.toLowerCase()===r.toLowerCase():!1}return!0}}}function K(t,e,n,a){if(e===n)return!0;const r=a||t;return r?r.toLowerCase()===e.toLowerCase():!1}function W(t){return{async resolveDataAdapters(e){try{return await t.getAdapters(e)}catch(n){console.error(`Failed to resolve data adapters for tenant ${e}:`,n);return}}}}function se(t){return`urn:authhero:tenant:${t.toLowerCase()}`}function Q(t){return{async beforeCreate(e,n){return!n.audience&&n.id?{...n,audience:se(n.id)}:n},async afterCreate(e,n){const{accessControl:a,databaseIsolation:r}=t;a&&e.ctx&&await oe(e,n,a),r!=null&&r.onProvision&&await r.onProvision(n.id)},async beforeDelete(e,n){const{accessControl:a,databaseIsolation:r}=t;if(a)try{const o=(await e.adapters.organizations.list(a.controlPlaneTenantId)).organizations.find(s=>s.name===n);o&&await e.adapters.organizations.remove(a.controlPlaneTenantId,o.id)}catch(c){console.warn(`Failed to remove organization for tenant ${n}:`,c)}if(r!=null&&r.onDeprovision)try{await r.onDeprovision(n)}catch(c){console.warn(`Failed to deprovision database for tenant ${n}:`,c)}}}}async function oe(t,e,n){const{controlPlaneTenantId:a,defaultPermissions:r,defaultRoles:c,issuer:o,adminRoleName:s="Tenant Admin",adminRoleDescription:d="Full access to all tenant management operations",addCreatorToOrganization:u=!0}=n,i=await t.adapters.organizations.create(a,{name:e.id,display_name:e.friendly_name||e.id});let f;if(o&&(f=await ce(t,a,s,d)),u&&t.ctx){const l=t.ctx.var.user;if(l!=null&&l.sub&&!await ie(t,a,l.sub))try{await t.adapters.userOrganizations.create(a,{user_id:l.sub,organization_id:i.id}),f&&await t.adapters.userRoles.create(a,l.sub,f,i.id)}catch(g){console.warn(`Failed to add creator ${l.sub} to organization ${i.id}:`,g)}}c&&c.length>0&&console.log(`Would assign roles ${c.join(", ")} to organization ${i.id}`),r&&r.length>0&&console.log(`Would grant permissions ${r.join(", ")} to organization ${i.id}`)}async function ie(t,e,n){const a=await t.adapters.userRoles.list(e,n,void 0,"");for(const r of a)if((await t.adapters.rolePermissions.list(e,r.id,{per_page:1e3})).some(s=>s.permission_name==="admin:organizations"))return!0;return!1}async function ce(t,e,n,a){const c=(await t.adapters.roles.list(e,{})).roles.find(u=>u.name===n);if(c)return c.id;const o=await t.adapters.roles.create(e,{name:n,description:a}),s=y.MANAGEMENT_API_AUDIENCE,d=y.MANAGEMENT_API_SCOPES.map(u=>({role_id:o.id,resource_server_identifier:s,permission_name:u.value}));return await t.adapters.rolePermissions.assign(e,o.id,d),o.id}function N(t,e,n=()=>!0){const{controlPlaneTenantId:a,getChildTenantIds:r,getAdapters:c}=t,o=new Map;async function s(i,f,l){return(await e(i).list(f,{q:`name:${l}`,per_page:1}))[0]??null}async function d(i){const f=await r(),l=e(await c(a));await Promise.all(f.map(async m=>{try{const g=await c(m),p=e(g),w={...l.transform(i),is_system:!0},h=await s(g,m,i.name),A=h?p.getId(h):void 0;if(h&&A){const C=p.preserveOnUpdate?p.preserveOnUpdate(h,w):w;await p.update(m,A,C)}else await p.create(m,w)}catch(g){console.error(`Failed to sync ${l.listKey} "${i.name}" to tenant "${m}":`,g)}}))}async function u(i){const f=await r();await Promise.all(f.map(async l=>{try{const m=await c(l),g=e(m),p=await s(m,l,i),v=p?g.getId(p):void 0;p&&v&&await g.remove(l,v)}catch(m){console.error(`Failed to delete entity "${i}" from tenant "${l}":`,m)}}))}return{afterCreate:async(i,f)=>{i.tenantId===a&&n(f)&&await d(f)},afterUpdate:async(i,f,l)=>{i.tenantId===a&&n(l)&&await d(l)},beforeDelete:async(i,f)=>{if(i.tenantId!==a)return;const m=await e(i.adapters).get(i.tenantId,f);m&&n(m)&&o.set(f,m)},afterDelete:async(i,f)=>{if(i.tenantId!==a)return;const l=o.get(f);l&&(o.delete(f),await u(l.name))}}}function H(t,e,n=()=>!0){const{controlPlaneTenantId:a,getControlPlaneAdapters:r,getAdapters:c}=t;return{async afterCreate(o,s){if(s.id!==a)try{const d=await r(),u=await c(s.id),i=e(d),f=e(u),l=await y.fetchAll(m=>i.listPaginated(a,m),i.listKey,{cursorField:"id",pageSize:100});await Promise.all(l.filter(m=>n(m)).map(async m=>{try{const g=i.transform(m);await f.create(s.id,{...g,is_system:!0})}catch(g){console.error(`Failed to sync entity to new tenant "${s.id}":`,g)}}))}catch(d){console.error(`Failed to sync entities to new tenant "${s.id}":`,d)}}}}const G=t=>({list:async(e,n)=>(await t.resourceServers.list(e,n)).resource_servers,listPaginated:(e,n)=>t.resourceServers.list(e,n),get:(e,n)=>t.resourceServers.get(e,n),create:(e,n)=>t.resourceServers.create(e,n),update:(e,n,a)=>t.resourceServers.update(e,n,a),remove:(e,n)=>t.resourceServers.remove(e,n),listKey:"resource_servers",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,identifier:e.identifier,scopes:e.scopes,signing_alg:e.signing_alg,token_lifetime:e.token_lifetime,token_lifetime_for_web:e.token_lifetime_for_web})}),U=t=>({list:async(e,n)=>(await t.roles.list(e,n)).roles,listPaginated:(e,n)=>t.roles.list(e,n),get:(e,n)=>t.roles.get(e,n),create:(e,n)=>t.roles.create(e,n),update:(e,n,a)=>t.roles.update(e,n,a),remove:(e,n)=>t.roles.remove(e,n),listKey:"roles",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,description:e.description})});function L(t){var e;return((e=t.metadata)==null?void 0:e.sync)!==!1}function V(t){const{sync:e={},filters:n={}}=t,a=e.resourceServers??!0,r=e.roles??!0,c=g=>L(g)?n.resourceServers?n.resourceServers(g):!0:!1,o=g=>L(g)?n.roles?n.roles(g):!0:!1,s=a?N(t,G,c):void 0,d=r?N(t,U,o):void 0,u=a?H(t,G,c):void 0,i=r?H(t,U,o):void 0,f=r?{async afterCreate(g,p){var v;if(p.id!==t.controlPlaneTenantId){await((v=i==null?void 0:i.afterCreate)==null?void 0:v.call(i,g,p));try{const w=await t.getControlPlaneAdapters(),h=await t.getAdapters(p.id),A=await y.fetchAll(b=>w.roles.list(t.controlPlaneTenantId,b),"roles",{cursorField:"id",pageSize:100}),C=new Map;for(const b of A.filter(_=>{var T;return((T=n.roles)==null?void 0:T.call(n,_))??!0})){const _=await l(h,p.id,b.name);_&&C.set(b.name,_.id)}for(const b of A.filter(_=>{var T;return((T=n.roles)==null?void 0:T.call(n,_))??!0})){const _=C.get(b.name);if(_)try{const T=await w.rolePermissions.list(t.controlPlaneTenantId,b.id,{});T.length>0&&await h.rolePermissions.assign(p.id,_,T.map(M=>({role_id:_,resource_server_identifier:M.resource_server_identifier,permission_name:M.permission_name})))}catch(T){console.error(`Failed to sync permissions for role "${b.name}" to tenant "${p.id}":`,T)}}}catch(w){console.error(`Failed to sync role permissions to tenant "${p.id}":`,w)}}}}:void 0;async function l(g,p,v){return(await g.roles.list(p,{q:`name:${v}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:s,roles:d},tenantHooks:{async afterCreate(g,p){const v=[u==null?void 0:u.afterCreate,(f==null?void 0:f.afterCreate)??(i==null?void 0:i.afterCreate)],w=[];for(const h of v)if(h)try{await h(g,p)}catch(A){w.push(A instanceof Error?A:new Error(String(A)))}if(w.length===1)throw w[0];if(w.length>1)throw new AggregateError(w,w.map(h=>h.message).join("; "))}}}}var S=class extends Error{constructor(e=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});F(this,"res");F(this,"status");this.res=n==null?void 0:n.res,this.status=e}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function R(t,e){const n=new I.OpenAPIHono;return n.openapi(I.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:y.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:I.z.object({tenants:I.z.array(y.tenantSchema),start:I.z.number().optional(),limit:I.z.number().optional(),length:I.z.number().optional()})}},description:"List of tenants"}}}),async a=>{var g,p,v,w,h,A;const r=a.req.valid("query"),{page:c,per_page:o,include_totals:s,q:d}=r,u=a.var.user,i=(u==null?void 0:u.permissions)||[];if(i.includes("auth:read")||i.includes("admin:organizations")){const C=await a.env.data.tenants.list({page:c,per_page:o,include_totals:s,q:d});return s?a.json({tenants:C.tenants,start:((g=C.totals)==null?void 0:g.start)??0,limit:((p=C.totals)==null?void 0:p.limit)??o,length:C.tenants.length}):a.json({tenants:C.tenants})}const l=((v=t.accessControl)==null?void 0:v.controlPlaneTenantId)??((w=a.env.data.multiTenancyConfig)==null?void 0:w.controlPlaneTenantId);if(l&&(u!=null&&u.sub)){const b=(await y.fetchAll(z=>a.env.data.userOrganizations.listUserOrganizations(l,u.sub,z),"organizations")).map(z=>z.name);if(b.length===0)return s?a.json({tenants:[],start:0,limit:o??50,length:0}):a.json({tenants:[]});const _=b.length,T=c??0,M=o??50,P=T*M,k=b.slice(P,P+M);if(k.length===0)return s?a.json({tenants:[],start:P,limit:M,length:_}):a.json({tenants:[]});const j=k.map(z=>`id:${z}`).join(" OR "),te=d?`(${j}) AND (${d})`:j,E=await a.env.data.tenants.list({q:te,per_page:M,include_totals:!1});return s?a.json({tenants:E.tenants,start:P,limit:M,length:_}):a.json({tenants:E.tenants})}const m=await a.env.data.tenants.list({page:c,per_page:o,include_totals:s,q:d});return s?a.json({tenants:m.tenants,start:((h=m.totals)==null?void 0:h.start)??0,limit:((A=m.totals)==null?void 0:A.limit)??o,length:m.tenants.length}):a.json({tenants:m.tenants})}),n.openapi(I.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:y.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:y.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async a=>{var d,u;const r=a.var.user;if(!(r!=null&&r.sub))throw new S(401,{message:"Authentication required to create tenants"});let c=a.req.valid("json");const o={adapters:a.env.data,ctx:a};(d=e.tenants)!=null&&d.beforeCreate&&(c=await e.tenants.beforeCreate(o,c));const s=await a.env.data.tenants.create(c);return(u=e.tenants)!=null&&u.afterCreate&&await e.tenants.afterCreate(o,s),a.json(s,201)}),n.openapi(I.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:I.z.object({id:I.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async a=>{var d,u,i,f;const{id:r}=a.req.valid("param"),c=((d=t.accessControl)==null?void 0:d.controlPlaneTenantId)??((u=a.env.data.multiTenancyConfig)==null?void 0:u.controlPlaneTenantId);if(c){const l=a.var.user;if(!(l!=null&&l.sub))throw new S(401,{message:"Authentication required"});if(r===c)throw new S(403,{message:"Cannot delete the control plane"});if(!(await y.fetchAll(p=>a.env.data.userOrganizations.listUserOrganizations(c,l.sub,p),"organizations")).some(p=>p.name===r))throw new S(403,{message:"Access denied to this tenant"})}if(!await a.env.data.tenants.get(r))throw new S(404,{message:"Tenant not found"});const s={adapters:a.env.data,ctx:a};return(i=e.tenants)!=null&&i.beforeDelete&&await e.tenants.beforeDelete(s,r),await a.env.data.tenants.remove(r),(f=e.tenants)!=null&&f.afterDelete&&await e.tenants.afterDelete(s,r),a.body(null,204)}),n}function le(t){const e=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:a}of e){const r=t.match(n);if(r&&r[1])return{type:a,id:r[1]}}return null}async function de(t,e,n){try{switch(n.type){case"resource_server":{const a=await t.resourceServers.get(e,n.id);return(a==null?void 0:a.is_system)===!0}case"role":{const a=await t.roles.get(e,n.id);return(a==null?void 0:a.is_system)===!0}case"connection":{const a=await t.connections.get(e,n.id);return(a==null?void 0:a.is_system)===!0}default:return!1}}catch{return!1}}function ue(t){return{resource_server:"resource server",role:"role",connection:"connection"}[t]}function J(){return async(t,e)=>{if(!["PATCH","PUT","DELETE"].includes(t.req.method))return e();const n=le(t.req.path);if(!n)return e();const a=t.var.tenant_id||t.req.header("x-tenant-id")||t.req.header("tenant-id");if(!a)return e();if(await de(t.env.data,a,n))throw new S(403,{message:`This ${ue(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return e()}}function D(t,e){const{controlPlaneTenantId:n,controlPlaneClientId:a}=e;return{...t,multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:a},legacyClients:{...t.legacyClients,get:async r=>{var f;const c=await t.legacyClients.get(r);if(!c)return null;const o=a?await t.legacyClients.get(a):void 0,s=await t.connections.list(c.tenant.id),d=n?await t.connections.list(n):{connections:[]},u=s.connections.map(l=>{var p;const m=(p=d.connections)==null?void 0:p.find(v=>v.strategy===l.strategy);if(!(m!=null&&m.options))return l;const g=y.connectionSchema.parse({...m||{},...l});return g.options=y.connectionOptionsSchema.parse({...m.options||{},...l.options}),g}).filter(l=>l),i={...(o==null?void 0:o.tenant)||{},...c.tenant};return!c.tenant.audience&&((f=o==null?void 0:o.tenant)!=null&&f.audience)&&(i.audience=o.tenant.audience),{...c,web_origins:[...(o==null?void 0:o.web_origins)||[],...c.web_origins||[]],allowed_logout_urls:[...(o==null?void 0:o.allowed_logout_urls)||[],...c.allowed_logout_urls||[]],callbacks:[...(o==null?void 0:o.callbacks)||[],...c.callbacks||[]],connections:u,tenant:i}}},connections:{...t.connections,get:async(r,c)=>{var i;const o=await t.connections.get(r,c);if(!o||!n||r===n)return o;const d=(i=(await t.connections.list(n)).connections)==null?void 0:i.find(f=>f.strategy===o.strategy);if(!(d!=null&&d.options))return o;const u=y.connectionSchema.parse({...d,...o});return u.options=y.connectionOptionsSchema.parse({...d.options||{},...o.options}),u},list:async(r,c)=>{const o=await t.connections.list(r,c);if(!n||r===n)return o;const s=await t.connections.list(n),d=o.connections.map(u=>{var l;const i=(l=s.connections)==null?void 0:l.find(m=>m.strategy===u.strategy);if(!(i!=null&&i.options))return u;const f=y.connectionSchema.parse({...i,...u});return f.options=y.connectionOptionsSchema.parse({...i.options||{},...u.options}),f});return{...o,connections:d}}}}}function $(t,e){return D(t,e)}const fe=D,me=$;function X(t){return async(e,n)=>{const a=e.var.user;return(a==null?void 0:a.tenant_id)===t&&a.org_name&&e.set("tenant_id",a.org_name),n()}}function Y(t){return async(e,n)=>{if(!t.accessControl)return n();const{controlPlaneTenantId:a}=t.accessControl,r=e.var.org_name,c=e.var.organization_id,o=r||c;let s=e.var.tenant_id;const d=e.var.user,i=(d!=null&&d.aud?Array.isArray(d.aud)?d.aud:[d.aud]:[]).includes(y.MANAGEMENT_API_AUDIENCE);if(!s&&o&&i&&(e.set("tenant_id",o),s=o),!s)throw new S(400,{message:"Tenant ID not found in request"});if(!K(c,s,a,r))throw new S(403,{message:`Access denied to tenant ${s}`});return n()}}function Z(t){return async(e,n)=>{if(!t.subdomainRouting)return n();const{baseDomain:a,reservedSubdomains:r=[],resolveSubdomain:c}=t.subdomainRouting,o=e.req.header("host")||"";let s=null;if(o.endsWith(a)){const u=o.slice(0,-(a.length+1));u&&!u.includes(".")&&(s=u)}if(s&&r.includes(s)&&(s=null),!s)return t.accessControl&&e.set("tenant_id",t.accessControl.controlPlaneTenantId),n();let d=null;if(c)d=await c(s);else if(t.subdomainRouting.useOrganizations!==!1&&t.accessControl)try{const u=await e.env.data.organizations.get(t.accessControl.controlPlaneTenantId,s);u&&(d=u.id)}catch{}if(!d)throw new S(404,{message:`Tenant not found for subdomain: ${s}`});return e.set("tenant_id",d),n()}}function x(t){return async(e,n)=>{if(!t.databaseIsolation)return n();const a=e.var.tenant_id;if(!a)throw new S(400,{message:"Tenant ID not found in request"});try{const r=await t.databaseIsolation.getAdapters(a);e.env.data=r}catch(r){throw console.error(`Failed to resolve database for tenant ${a}:`,r),new S(500,{message:"Failed to resolve tenant database"})}return n()}}function q(t){const e=Z(t),n=Y(t),a=x(t);return async(r,c)=>(await e(r,async()=>{}),await n(r,async()=>{}),await a(r,async()=>{}),c())}function ge(t){const{dataAdapter:e,controlPlane:n,sync:a={resourceServers:!0,roles:!0},defaultPermissions:r=["tenant:admin"],requireOrganizationMatch:c=!1,managementApiExtensions:o=[],entityHooks:s,getChildTenantIds:d,getAdapters:u,...i}=t,f=(n==null?void 0:n.tenantId)??"control_plane",l=n==null?void 0:n.clientId,m=n?$(e,{controlPlaneTenantId:f,controlPlaneClientId:l}):e,g=a!==!1,p=g?{resourceServers:a.resourceServers??!0,roles:a.roles??!0}:{resourceServers:!1,roles:!1},h={controlPlaneTenantId:f,getChildTenantIds:d??(async()=>(await y.fetchAll(P=>m.tenants.list(P),"tenants",{cursorField:"id",pageSize:100})).filter(P=>P.id!==f).map(P=>P.id)),getAdapters:u??(async()=>m),getControlPlaneAdapters:async()=>m,sync:p},{entityHooks:A,tenantHooks:C}=V(h),b={resourceServers:[A.resourceServers,...(s==null?void 0:s.resourceServers)??[]],roles:[A.roles,...(s==null?void 0:s.roles)??[]],connections:(s==null?void 0:s.connections)??[],tenants:(s==null?void 0:s.tenants)??[],rolePermissions:(s==null?void 0:s.rolePermissions)??[]},_=R({accessControl:{controlPlaneTenantId:f,requireOrganizationMatch:c,defaultPermissions:r}},{tenants:C}),{app:T}=y.init({dataAdapter:m,...i,entityHooks:b,managementApiExtensions:[...o,{path:"/tenants",router:_}]});return T.use("/api/v2/*",X(f)),g&&T.use("/api/v2/*",J()),{app:T,controlPlaneTenantId:f}}function pe(t){const e=O(t);return{name:"multi-tenancy",middleware:q(t),hooks:e,routes:[{path:"/management",handler:R(t,e)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),t.accessControl&&console.log(`  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`),t.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`),t.databaseIsolation&&console.log("  - Database isolation enabled")}}}function O(t){const e=t.accessControl?B(t.accessControl):{},n=t.databaseIsolation?W(t.databaseIsolation):{},a=Q(t);return{...e,...n,tenants:a}}function ee(t){const e=new re.Hono,n=O(t);return e.route("/tenants",R(t,n)),e}function we(t){return{hooks:O(t),middleware:q(t),app:ee(t),config:t,wrapAdapters:(e,n)=>{var a;return $(e,{controlPlaneTenantId:(a=t.accessControl)==null?void 0:a.controlPlaneTenantId,controlPlaneClientId:n==null?void 0:n.controlPlaneClientId})}}}exports.createAccessControlHooks=B;exports.createAccessControlMiddleware=Y;exports.createControlPlaneTenantMiddleware=X;exports.createDatabaseHooks=W;exports.createDatabaseMiddleware=x;exports.createMultiTenancy=ee;exports.createMultiTenancyHooks=O;exports.createMultiTenancyMiddleware=q;exports.createMultiTenancyPlugin=pe;exports.createProtectSyncedMiddleware=J;exports.createProvisioningHooks=Q;exports.createRuntimeFallbackAdapter=D;exports.createSettingsInheritanceAdapter=fe;exports.createSubdomainMiddleware=Z;exports.createSyncHooks=V;exports.createTenantsOpenAPIRouter=R;exports.initMultiTenant=ge;exports.setupMultiTenancy=we;exports.validateTenantAccess=K;exports.withRuntimeFallback=$;exports.withSettingsInheritance=me;
+"use strict";var re=Object.defineProperty;var ae=(t,e,n)=>e in t?re(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var D=(t,e,n)=>ae(t,typeof e!="symbol"?e+"":e,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const se=require("hono"),y=require("authhero"),I=require("@hono/zod-openapi");function B(t){const{controlPlaneTenantId:e,requireOrganizationMatch:n=!0}=t;return{async onTenantAccessValidation(r,a){if(a===e)return!0;if(n){const c=r.var.org_name,d=r.var.organization_id,s=c||d;return s?s.toLowerCase()===a.toLowerCase():!1}return!0}}}function K(t,e,n,r){if(e===n)return!0;const a=r||t;return a?a.toLowerCase()===e.toLowerCase():!1}function V(t){return{async resolveDataAdapters(e){try{return await t.getAdapters(e)}catch(n){console.error(`Failed to resolve data adapters for tenant ${e}:`,n);return}}}}function oe(t){return`urn:authhero:tenant:${t.toLowerCase()}`}function W(t){return{async beforeCreate(e,n){return!n.audience&&n.id?{...n,audience:oe(n.id)}:n},async afterCreate(e,n){const{accessControl:r,databaseIsolation:a}=t;r&&e.ctx&&await ie(e,n,r),a!=null&&a.onProvision&&await a.onProvision(n.id)},async beforeDelete(e,n){const{accessControl:r,databaseIsolation:a}=t;if(r)try{const d=(await e.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find(s=>s.name===n);d&&await e.adapters.organizations.remove(r.controlPlaneTenantId,d.id)}catch(c){console.warn(`Failed to remove organization for tenant ${n}:`,c)}if(a!=null&&a.onDeprovision)try{await a.onDeprovision(n)}catch(c){console.warn(`Failed to deprovision database for tenant ${n}:`,c)}}}}async function ie(t,e,n){const{controlPlaneTenantId:r,defaultPermissions:a,defaultRoles:c,issuer:d,adminRoleName:s="Tenant Admin",adminRoleDescription:f="Full access to all tenant management operations",addCreatorToOrganization:o=!0}=n,i=await t.adapters.organizations.create(r,{name:e.id,display_name:e.friendly_name||e.id});let u;if(d&&(u=await le(t,r,s,f)),o&&t.ctx){const l=t.ctx.var.user;if(l!=null&&l.sub&&!await ce(t,r,l.sub))try{await t.adapters.userOrganizations.create(r,{user_id:l.sub,organization_id:i.id}),u&&await t.adapters.userRoles.create(r,l.sub,u,i.id)}catch(p){console.warn(`Failed to add creator ${l.sub} to organization ${i.id}:`,p)}}c&&c.length>0&&console.log(`Would assign roles ${c.join(", ")} to organization ${i.id}`),a&&a.length>0&&console.log(`Would grant permissions ${a.join(", ")} to organization ${i.id}`)}async function ce(t,e,n){const r=await t.adapters.userRoles.list(e,n,void 0,"");for(const a of r)if((await t.adapters.rolePermissions.list(e,a.id,{per_page:1e3})).some(s=>s.permission_name==="admin:organizations"))return!0;return!1}async function le(t,e,n,r){const c=(await t.adapters.roles.list(e,{})).roles.find(o=>o.name===n);if(c)return c.id;const d=await t.adapters.roles.create(e,{name:n,description:r}),s=y.MANAGEMENT_API_AUDIENCE,f=y.MANAGEMENT_API_SCOPES.map(o=>({role_id:d.id,resource_server_identifier:s,permission_name:o.value}));return await t.adapters.rolePermissions.assign(e,d.id,f),d.id}function k(t,e,n=()=>!0){const{controlPlaneTenantId:r,getChildTenantIds:a,getAdapters:c}=t,d=new Map;async function s(i,u,l){return(await e(i).list(u,{q:`name:${l}`,per_page:1}))[0]??null}async function f(i){const u=await a(),l=e(await c(r));await Promise.all(u.map(async m=>{try{const p=await c(m),g=e(p),w={...l.transform(i),is_system:!0},h=await s(p,m,i.name),A=h?g.getId(h):void 0;if(h&&A){const P=g.preserveOnUpdate?g.preserveOnUpdate(h,w):w;await g.update(m,A,P)}else await g.create(m,w)}catch(p){console.error(`Failed to sync ${l.listKey} "${i.name}" to tenant "${m}":`,p)}}))}async function o(i){const u=await a();await Promise.all(u.map(async l=>{try{const m=await c(l),p=e(m),g=await s(m,l,i),v=g?p.getId(g):void 0;g&&v&&await p.remove(l,v)}catch(m){console.error(`Failed to delete entity "${i}" from tenant "${l}":`,m)}}))}return{afterCreate:async(i,u)=>{i.tenantId===r&&n(u)&&await f(u)},afterUpdate:async(i,u,l)=>{i.tenantId===r&&n(l)&&await f(l)},beforeDelete:async(i,u)=>{if(i.tenantId!==r)return;const m=await e(i.adapters).get(i.tenantId,u);m&&n(m)&&d.set(u,m)},afterDelete:async(i,u)=>{if(i.tenantId!==r)return;const l=d.get(u);l&&(d.delete(u),await o(l.name))}}}function N(t,e,n=()=>!0){const{controlPlaneTenantId:r,getControlPlaneAdapters:a,getAdapters:c}=t;return{async afterCreate(d,s){if(s.id!==r)try{const f=await a(),o=await c(s.id),i=e(f),u=e(o),l=await y.fetchAll(m=>i.listPaginated(r,m),i.listKey,{cursorField:"id",pageSize:100});await Promise.all(l.filter(m=>n(m)).map(async m=>{try{const p=i.transform(m);await u.create(s.id,{...p,is_system:!0})}catch(p){console.error(`Failed to sync entity to new tenant "${s.id}":`,p)}}))}catch(f){console.error(`Failed to sync entities to new tenant "${s.id}":`,f)}}}}const H=t=>({list:async(e,n)=>(await t.resourceServers.list(e,n)).resource_servers,listPaginated:(e,n)=>t.resourceServers.list(e,n),get:(e,n)=>t.resourceServers.get(e,n),create:(e,n)=>t.resourceServers.create(e,n),update:(e,n,r)=>t.resourceServers.update(e,n,r),remove:(e,n)=>t.resourceServers.remove(e,n),listKey:"resource_servers",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,identifier:e.identifier,scopes:e.scopes,signing_alg:e.signing_alg,token_lifetime:e.token_lifetime,token_lifetime_for_web:e.token_lifetime_for_web})}),G=t=>({list:async(e,n)=>(await t.roles.list(e,n)).roles,listPaginated:(e,n)=>t.roles.list(e,n),get:(e,n)=>t.roles.get(e,n),create:(e,n)=>t.roles.create(e,n),update:(e,n,r)=>t.roles.update(e,n,r),remove:(e,n)=>t.roles.remove(e,n),listKey:"roles",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,description:e.description})});function L(t){var e;return((e=t.metadata)==null?void 0:e.sync)!==!1}function Q(t){const{sync:e={},filters:n={}}=t,r=e.resourceServers??!0,a=e.roles??!0,c=p=>L(p)?n.resourceServers?n.resourceServers(p):!0:!1,d=p=>L(p)?n.roles?n.roles(p):!0:!1,s=r?k(t,H,c):void 0,f=a?k(t,G,d):void 0,o=r?N(t,H,c):void 0,i=a?N(t,G,d):void 0,u=a?{async afterCreate(p,g){var v;if(g.id!==t.controlPlaneTenantId){await((v=i==null?void 0:i.afterCreate)==null?void 0:v.call(i,p,g));try{const w=await t.getControlPlaneAdapters(),h=await t.getAdapters(g.id),A=await y.fetchAll(_=>w.roles.list(t.controlPlaneTenantId,_),"roles",{cursorField:"id",pageSize:100}),P=new Map;for(const _ of A.filter(T=>{var b;return((b=n.roles)==null?void 0:b.call(n,T))??!0})){const T=await l(h,g.id,_.name);T&&P.set(_.name,T.id)}for(const _ of A.filter(T=>{var b;return((b=n.roles)==null?void 0:b.call(n,T))??!0})){const T=P.get(_.name);if(T)try{const b=await w.rolePermissions.list(t.controlPlaneTenantId,_.id,{});b.length>0&&await h.rolePermissions.assign(g.id,T,b.map(C=>({role_id:T,resource_server_identifier:C.resource_server_identifier,permission_name:C.permission_name})))}catch(b){console.error(`Failed to sync permissions for role "${_.name}" to tenant "${g.id}":`,b)}}}catch(w){console.error(`Failed to sync role permissions to tenant "${g.id}":`,w)}}}}:void 0;async function l(p,g,v){return(await p.roles.list(g,{q:`name:${v}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:s,roles:f},tenantHooks:{async afterCreate(p,g){const v=[o==null?void 0:o.afterCreate,(u==null?void 0:u.afterCreate)??(i==null?void 0:i.afterCreate)],w=[];for(const h of v)if(h)try{await h(p,g)}catch(A){w.push(A instanceof Error?A:new Error(String(A)))}if(w.length===1)throw w[0];if(w.length>1)throw new AggregateError(w,w.map(h=>h.message).join("; "))}}}}var S=class extends Error{constructor(e=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});D(this,"res");D(this,"status");this.res=n==null?void 0:n.res,this.status=e}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function $(t,e){const n=new I.OpenAPIHono;return n.openapi(I.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:y.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:I.z.object({tenants:I.z.array(y.tenantSchema),start:I.z.number().optional(),limit:I.z.number().optional(),length:I.z.number().optional()})}},description:"List of tenants"}}}),async r=>{var p,g,v,w,h,A;const a=r.req.valid("query"),{page:c,per_page:d,include_totals:s,q:f}=a,o=r.var.user,i=(o==null?void 0:o.permissions)||[];if(i.includes("auth:read")||i.includes("admin:organizations")){const P=await r.env.data.tenants.list({page:c,per_page:d,include_totals:s,q:f});return s?r.json({tenants:P.tenants,start:((p=P.totals)==null?void 0:p.start)??0,limit:((g=P.totals)==null?void 0:g.limit)??d,length:P.tenants.length}):r.json({tenants:P.tenants})}const l=((v=t.accessControl)==null?void 0:v.controlPlaneTenantId)??((w=r.env.data.multiTenancyConfig)==null?void 0:w.controlPlaneTenantId);if(l&&(o!=null&&o.sub)){const _=(await y.fetchAll(O=>r.env.data.userOrganizations.listUserOrganizations(l,o.sub,O),"organizations")).map(O=>O.name);if(_.length===0)return s?r.json({tenants:[],start:0,limit:d??50,length:0}):r.json({tenants:[]});const T=_.length,b=c??0,C=d??50,z=b*C,M=_.slice(z,z+C);if(M.length===0)return s?r.json({tenants:[],start:z,limit:C,length:T}):r.json({tenants:[]});const E=M.map(O=>`id:${O}`).join(" OR "),ne=f?`(${E}) AND (${f})`:E,j=await r.env.data.tenants.list({q:ne,per_page:C,include_totals:!1});return s?r.json({tenants:j.tenants,start:z,limit:C,length:T}):r.json({tenants:j.tenants})}const m=await r.env.data.tenants.list({page:c,per_page:d,include_totals:s,q:f});return s?r.json({tenants:m.tenants,start:((h=m.totals)==null?void 0:h.start)??0,limit:((A=m.totals)==null?void 0:A.limit)??d,length:m.tenants.length}):r.json({tenants:m.tenants})}),n.openapi(I.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:y.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:y.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async r=>{var f,o;const a=r.var.user;if(!(a!=null&&a.sub))throw new S(401,{message:"Authentication required to create tenants"});let c=r.req.valid("json");const d={adapters:r.env.data,ctx:r};(f=e.tenants)!=null&&f.beforeCreate&&(c=await e.tenants.beforeCreate(d,c));const s=await r.env.data.tenants.create(c);return(o=e.tenants)!=null&&o.afterCreate&&await e.tenants.afterCreate(d,s),r.json(s,201)}),n.openapi(I.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:I.z.object({id:I.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async r=>{var f,o,i,u;const{id:a}=r.req.valid("param"),c=((f=t.accessControl)==null?void 0:f.controlPlaneTenantId)??((o=r.env.data.multiTenancyConfig)==null?void 0:o.controlPlaneTenantId);if(c){const l=r.var.user;if(!(l!=null&&l.sub))throw new S(401,{message:"Authentication required"});if(a===c)throw new S(403,{message:"Cannot delete the control plane"});if(!(await y.fetchAll(g=>r.env.data.userOrganizations.listUserOrganizations(c,l.sub,g),"organizations")).some(g=>g.name===a))throw new S(403,{message:"Access denied to this tenant"})}if(!await r.env.data.tenants.get(a))throw new S(404,{message:"Tenant not found"});const s={adapters:r.env.data,ctx:r};return(i=e.tenants)!=null&&i.beforeDelete&&await e.tenants.beforeDelete(s,a),await r.env.data.tenants.remove(a),(u=e.tenants)!=null&&u.afterDelete&&await e.tenants.afterDelete(s,a),r.body(null,204)}),n}function de(t){const e=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:r}of e){const a=t.match(n);if(a&&a[1])return{type:r,id:a[1]}}return null}async function ue(t,e,n){try{switch(n.type){case"resource_server":{const r=await t.resourceServers.get(e,n.id);return(r==null?void 0:r.is_system)===!0}case"role":{const r=await t.roles.get(e,n.id);return(r==null?void 0:r.is_system)===!0}case"connection":{const r=await t.connections.get(e,n.id);return(r==null?void 0:r.is_system)===!0}default:return!1}}catch{return!1}}function fe(t){return{resource_server:"resource server",role:"role",connection:"connection"}[t]}function J(){return async(t,e)=>{if(!["PATCH","PUT","DELETE"].includes(t.req.method))return e();const n=de(t.req.path);if(!n)return e();const r=t.var.tenant_id||t.req.header("x-tenant-id")||t.req.header("tenant-id");if(!r)return e();if(await ue(t.env.data,r,n))throw new S(403,{message:`This ${fe(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return e()}}const me=["client_secret","app_secret","twilio_token"];function U(t){if(!t)return t;const e={...t};for(const n of me)delete e[n];return e}function X(t,e){const{controlPlaneTenantId:n,controlPlaneClientId:r,excludeSensitiveFields:a=!1}=e;return{...t,multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:r},connections:{...t.connections,get:async(c,d)=>{var l;const s=await t.connections.get(c,d);if(!s||!n||c===n)return s;const o=(l=(await t.connections.list(n)).connections)==null?void 0:l.find(m=>m.strategy===s.strategy);if(!(o!=null&&o.options))return s;const i=y.connectionSchema.parse({...o,...s}),u=a?U(o.options):o.options;return i.options=y.connectionOptionsSchema.parse({...u||{},...s.options}),i},list:async(c,d)=>{const s=await t.connections.list(c,d);if(!n||c===n)return s;const f=await t.connections.list(n),o=s.connections.map(i=>{var p;const u=(p=f.connections)==null?void 0:p.find(g=>g.strategy===i.strategy);if(!(u!=null&&u.options))return i;const l=y.connectionSchema.parse({...u,...i}),m=a?U(u.options):u.options;return l.options=y.connectionOptionsSchema.parse({...m||{},...i.options}),l});return{...s,connections:o}}}}}function R(t,e){return X(t,e)}function Y(t){return async(e,n)=>{const r=e.var.user;return(r==null?void 0:r.tenant_id)===t&&r.org_name&&e.set("tenant_id",r.org_name),n()}}function Z(t){return async(e,n)=>{if(!t.accessControl)return n();const{controlPlaneTenantId:r}=t.accessControl,a=e.var.org_name,c=e.var.organization_id,d=a||c;let s=e.var.tenant_id;const f=e.var.user,i=(f!=null&&f.aud?Array.isArray(f.aud)?f.aud:[f.aud]:[]).includes(y.MANAGEMENT_API_AUDIENCE);if(!s&&d&&i&&(e.set("tenant_id",d),s=d),!s)throw new S(400,{message:"Tenant ID not found in request"});if(!K(c,s,r,a))throw new S(403,{message:`Access denied to tenant ${s}`});return n()}}function x(t){return async(e,n)=>{if(!t.subdomainRouting)return n();const{baseDomain:r,reservedSubdomains:a=[],resolveSubdomain:c}=t.subdomainRouting,d=e.req.header("host")||"";let s=null;if(d.endsWith(r)){const o=d.slice(0,-(r.length+1));o&&!o.includes(".")&&(s=o)}if(s&&a.includes(s)&&(s=null),!s)return t.accessControl&&e.set("tenant_id",t.accessControl.controlPlaneTenantId),n();let f=null;if(c)f=await c(s);else if(t.subdomainRouting.useOrganizations!==!1&&t.accessControl)try{const o=await e.env.data.organizations.get(t.accessControl.controlPlaneTenantId,s);o&&(f=o.id)}catch{}if(!f)throw new S(404,{message:`Tenant not found for subdomain: ${s}`});return e.set("tenant_id",f),n()}}function ee(t){return async(e,n)=>{if(!t.databaseIsolation)return n();const r=e.var.tenant_id;if(!r)throw new S(400,{message:"Tenant ID not found in request"});try{const a=await t.databaseIsolation.getAdapters(r);e.env.data=a}catch(a){throw console.error(`Failed to resolve database for tenant ${r}:`,a),new S(500,{message:"Failed to resolve tenant database"})}return n()}}function q(t){const e=x(t),n=Z(t),r=ee(t);return async(a,c)=>(await e(a,async()=>{}),await n(a,async()=>{}),await r(a,async()=>{}),c())}function pe(t){const{dataAdapter:e,controlPlane:n,controlPlane:{tenantId:r="control_plane",clientId:a}={},sync:c={resourceServers:!0,roles:!0},defaultPermissions:d=["tenant:admin"],requireOrganizationMatch:s=!1,managementApiExtensions:f=[],entityHooks:o,getChildTenantIds:i,getAdapters:u,...l}=t;let m=e,p=e;n&&(m=R(e,{controlPlaneTenantId:r,controlPlaneClientId:a}),p=R(e,{controlPlaneTenantId:r,controlPlaneClientId:a,excludeSensitiveFields:!0}));const g=c!==!1,v=g?{resourceServers:c.resourceServers??!0,roles:c.roles??!0}:{resourceServers:!1,roles:!1},A={controlPlaneTenantId:r,getChildTenantIds:i??(async()=>(await y.fetchAll(M=>m.tenants.list(M),"tenants",{cursorField:"id",pageSize:100})).filter(M=>M.id!==r).map(M=>M.id)),getAdapters:u??(async()=>m),getControlPlaneAdapters:async()=>m,sync:v},{entityHooks:P,tenantHooks:_}=Q(A),T={resourceServers:[P.resourceServers,...(o==null?void 0:o.resourceServers)??[]],roles:[P.roles,...(o==null?void 0:o.roles)??[]],connections:(o==null?void 0:o.connections)??[],tenants:(o==null?void 0:o.tenants)??[],rolePermissions:(o==null?void 0:o.rolePermissions)??[]},b=$({accessControl:{controlPlaneTenantId:r,requireOrganizationMatch:s,defaultPermissions:d}},{tenants:_}),{app:C}=y.init({dataAdapter:m,managementDataAdapter:p,...l,entityHooks:T,managementApiExtensions:[...f,{path:"/tenants",router:b}]});return C.use("/api/v2/*",Y(r)),g&&C.use("/api/v2/*",J()),{app:C,controlPlaneTenantId:r}}function ge(t){const e=F(t);return{name:"multi-tenancy",middleware:q(t),hooks:e,routes:[{path:"/management",handler:$(t,e)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),t.accessControl&&console.log(`  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`),t.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`),t.databaseIsolation&&console.log("  - Database isolation enabled")}}}function F(t){const e=t.accessControl?B(t.accessControl):{},n=t.databaseIsolation?V(t.databaseIsolation):{},r=W(t);return{...e,...n,tenants:r}}function te(t){const e=new se.Hono,n=F(t);return e.route("/tenants",$(t,n)),e}function we(t){return{hooks:F(t),middleware:q(t),app:te(t),config:t,wrapAdapters:(e,n)=>{var r;return R(e,{controlPlaneTenantId:(r=t.accessControl)==null?void 0:r.controlPlaneTenantId,controlPlaneClientId:n==null?void 0:n.controlPlaneClientId})}}}exports.createAccessControlHooks=B;exports.createAccessControlMiddleware=Z;exports.createControlPlaneTenantMiddleware=Y;exports.createDatabaseHooks=V;exports.createDatabaseMiddleware=ee;exports.createMultiTenancy=te;exports.createMultiTenancyHooks=F;exports.createMultiTenancyMiddleware=q;exports.createMultiTenancyPlugin=ge;exports.createProtectSyncedMiddleware=J;exports.createProvisioningHooks=W;exports.createRuntimeFallbackAdapter=X;exports.createSubdomainMiddleware=x;exports.createSyncHooks=Q;exports.createTenantsOpenAPIRouter=$;exports.initMultiTenant=pe;exports.setupMultiTenancy=we;exports.validateTenantAccess=K;exports.withRuntimeFallback=R;