@authhero/multi-tenancy 14.6.0 → 14.7.0

package/dist/multi-tenancy.cjs

@@ -1 +1 @@
-"use strict";var ae=Object.defineProperty;var re=(t,e,n)=>e in t?ae(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var D=(t,e,n)=>re(t,typeof e!="symbol"?e+"":e,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const se=require("hono"),y=require("authhero"),S=require("@hono/zod-openapi");function B(t){const{controlPlaneTenantId:e,requireOrganizationMatch:n=!0}=t;return{async onTenantAccessValidation(a,s){if(s===e)return!0;if(n){const c=a.var.org_name,l=a.var.organization_id,r=c||l;return r?r.toLowerCase()===s.toLowerCase():!1}return!0}}}function K(t,e,n,a){if(e===n)return!0;const s=a||t;return s?s.toLowerCase()===e.toLowerCase():!1}function V(t){return{async resolveDataAdapters(e){try{return await t.getAdapters(e)}catch(n){console.error(`Failed to resolve data adapters for tenant ${e}:`,n);return}}}}function oe(t){return`urn:authhero:tenant:${t.toLowerCase()}`}function W(t){return{async beforeCreate(e,n){return!n.audience&&n.id?{...n,audience:oe(n.id)}:n},async afterCreate(e,n){const{accessControl:a,databaseIsolation:s}=t;a&&e.ctx&&await ie(e,n,a),s!=null&&s.onProvision&&await s.onProvision(n.id)},async beforeDelete(e,n){const{accessControl:a,databaseIsolation:s}=t;if(a)try{const l=(await e.adapters.organizations.list(a.controlPlaneTenantId)).organizations.find(r=>r.name===n);l&&await e.adapters.organizations.remove(a.controlPlaneTenantId,l.id)}catch(c){console.warn(`Failed to remove organization for tenant ${n}:`,c)}if(s!=null&&s.onDeprovision)try{await s.onDeprovision(n)}catch(c){console.warn(`Failed to deprovision database for tenant ${n}:`,c)}}}}async function ie(t,e,n){const{controlPlaneTenantId:a,defaultPermissions:s,defaultRoles:c,issuer:l,adminRoleName:r="Tenant Admin",adminRoleDescription:p="Full access to all tenant management operations",addCreatorToOrganization:o=!0}=n,i=await t.adapters.organizations.create(a,{name:e.id,display_name:e.friendly_name||e.id});let f;if(l&&(f=await le(t,a,r,p)),o&&t.ctx){const d=t.ctx.var.user;if(d!=null&&d.sub&&!await ce(t,a,d.sub))try{await t.adapters.userOrganizations.create(a,{user_id:d.sub,organization_id:i.id}),f&&await t.adapters.userRoles.create(a,d.sub,f,i.id)}catch(m){console.warn(`Failed to add creator ${d.sub} to organization ${i.id}:`,m)}}c&&c.length>0&&console.log(`Would assign roles ${c.join(", ")} to organization ${i.id}`),s&&s.length>0&&console.log(`Would grant permissions ${s.join(", ")} to organization ${i.id}`)}async function ce(t,e,n){const a=await t.adapters.userRoles.list(e,n,void 0,"");for(const s of a)if((await t.adapters.rolePermissions.list(e,s.id,{per_page:1e3})).some(r=>r.permission_name==="admin:organizations"))return!0;return!1}async function le(t,e,n,a){const c=(await t.adapters.roles.list(e,{})).roles.find(o=>o.name===n);if(c)return c.id;const l=await t.adapters.roles.create(e,{name:n,description:a}),r=y.MANAGEMENT_API_AUDIENCE,p=y.MANAGEMENT_API_SCOPES.map(o=>({role_id:l.id,resource_server_identifier:r,permission_name:o.value}));return await t.adapters.rolePermissions.assign(e,l.id,p),l.id}function N(t,e,n=()=>!0){const{controlPlaneTenantId:a,getChildTenantIds:s,getAdapters:c}=t,l=new Map;async function r(i,f,d){return(await e(i).list(f,{q:`name:${d}`,per_page:1}))[0]??null}async function p(i){const f=await s(),d=e(await c(a));await Promise.all(f.map(async u=>{try{const m=await c(u),g=e(m),w={...d.transform(i),is_system:!0},h=await r(m,u,i.name),_=h?g.getId(h):void 0;if(h&&_){const A=g.preserveOnUpdate?g.preserveOnUpdate(h,w):w;await g.update(u,_,A)}else await g.create(u,w)}catch(m){console.error(`Failed to sync ${d.listKey} "${i.name}" to tenant "${u}":`,m)}}))}async function o(i){const f=await s();await Promise.all(f.map(async d=>{try{const u=await c(d),m=e(u),g=await r(u,d,i),v=g?m.getId(g):void 0;g&&v&&await m.remove(d,v)}catch(u){console.error(`Failed to delete entity "${i}" from tenant "${d}":`,u)}}))}return{afterCreate:async(i,f)=>{i.tenantId===a&&n(f)&&await p(f)},afterUpdate:async(i,f,d)=>{i.tenantId===a&&n(d)&&await p(d)},beforeDelete:async(i,f)=>{if(i.tenantId!==a)return;const u=await e(i.adapters).get(i.tenantId,f);u&&n(u)&&l.set(f,u)},afterDelete:async(i,f)=>{if(i.tenantId!==a)return;const d=l.get(f);d&&(l.delete(f),await o(d.name))}}}function H(t,e,n=()=>!0){const{controlPlaneTenantId:a,getControlPlaneAdapters:s,getAdapters:c}=t;return{async afterCreate(l,r){if(r.id!==a)try{const p=await s(),o=await c(r.id),i=e(p),f=e(o),d=await y.fetchAll(u=>i.listPaginated(a,u),i.listKey,{cursorField:"id",pageSize:100});await Promise.all(d.filter(u=>n(u)).map(async u=>{try{const m=i.transform(u);await f.create(r.id,{...m,is_system:!0})}catch(m){console.error(`Failed to sync entity to new tenant "${r.id}":`,m)}}))}catch(p){console.error(`Failed to sync entities to new tenant "${r.id}":`,p)}}}}const G=t=>({list:async(e,n)=>(await t.resourceServers.list(e,n)).resource_servers,listPaginated:(e,n)=>t.resourceServers.list(e,n),get:(e,n)=>t.resourceServers.get(e,n),create:(e,n)=>t.resourceServers.create(e,n),update:(e,n,a)=>t.resourceServers.update(e,n,a),remove:(e,n)=>t.resourceServers.remove(e,n),listKey:"resource_servers",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,identifier:e.identifier,scopes:e.scopes,signing_alg:e.signing_alg,token_lifetime:e.token_lifetime,token_lifetime_for_web:e.token_lifetime_for_web})}),L=t=>({list:async(e,n)=>(await t.roles.list(e,n)).roles,listPaginated:(e,n)=>t.roles.list(e,n),get:(e,n)=>t.roles.get(e,n),create:(e,n)=>t.roles.create(e,n),update:(e,n,a)=>t.roles.update(e,n,a),remove:(e,n)=>t.roles.remove(e,n),listKey:"roles",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,description:e.description})});function U(t){var e;return((e=t.metadata)==null?void 0:e.sync)!==!1}function Q(t){const{sync:e={},filters:n={}}=t,a=e.resourceServers??!0,s=e.roles??!0,c=m=>U(m)?n.resourceServers?n.resourceServers(m):!0:!1,l=m=>U(m)?n.roles?n.roles(m):!0:!1,r=a?N(t,G,c):void 0,p=s?N(t,L,l):void 0,o=a?H(t,G,c):void 0,i=s?H(t,L,l):void 0,f=s?{async afterCreate(m,g){var v;if(g.id!==t.controlPlaneTenantId){await((v=i==null?void 0:i.afterCreate)==null?void 0:v.call(i,m,g));try{const w=await t.getControlPlaneAdapters(),h=await t.getAdapters(g.id),_=await y.fetchAll(b=>w.roles.list(t.controlPlaneTenantId,b),"roles",{cursorField:"id",pageSize:100}),A=new Map;for(const b of _.filter(T=>{var C;return((C=n.roles)==null?void 0:C.call(n,T))??!0})){const T=await d(h,g.id,b.name);T&&A.set(b.name,T.id)}for(const b of _.filter(T=>{var C;return((C=n.roles)==null?void 0:C.call(n,T))??!0})){const T=A.get(b.name);if(T)try{const C=await w.rolePermissions.list(t.controlPlaneTenantId,b.id,{});C.length>0&&await h.rolePermissions.assign(g.id,T,C.map(P=>({role_id:T,resource_server_identifier:P.resource_server_identifier,permission_name:P.permission_name})))}catch(C){console.error(`Failed to sync permissions for role "${b.name}" to tenant "${g.id}":`,C)}}}catch(w){console.error(`Failed to sync role permissions to tenant "${g.id}":`,w)}}}}:void 0;async function d(m,g,v){return(await m.roles.list(g,{q:`name:${v}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:r,roles:p},tenantHooks:{async afterCreate(m,g){const v=[o==null?void 0:o.afterCreate,(f==null?void 0:f.afterCreate)??(i==null?void 0:i.afterCreate)],w=[];for(const h of v)if(h)try{await h(m,g)}catch(_){w.push(_ instanceof Error?_:new Error(String(_)))}if(w.length===1)throw w[0];if(w.length>1)throw new AggregateError(w,w.map(h=>h.message).join("; "))}}}}var I=class extends Error{constructor(e=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});D(this,"res");D(this,"status");this.res=n==null?void 0:n.res,this.status=e}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function $(t,e){const n=new S.OpenAPIHono;return n.openapi(S.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:y.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:S.z.object({tenants:S.z.array(y.tenantSchema),start:S.z.number().optional(),limit:S.z.number().optional(),length:S.z.number().optional()})}},description:"List of tenants"}}}),async a=>{var m,g,v,w,h,_;const s=a.req.valid("query"),{page:c,per_page:l,include_totals:r,q:p}=s,o=a.var.user,i=(o==null?void 0:o.permissions)||[];if(i.includes("auth:read")||i.includes("admin:organizations")){const A=await a.env.data.tenants.list({page:c,per_page:l,include_totals:r,q:p});return r?a.json({tenants:A.tenants,start:((m=A.totals)==null?void 0:m.start)??0,limit:((g=A.totals)==null?void 0:g.limit)??l,length:A.tenants.length}):a.json({tenants:A.tenants})}const d=((v=t.accessControl)==null?void 0:v.controlPlaneTenantId)??((w=a.env.data.multiTenancyConfig)==null?void 0:w.controlPlaneTenantId);if(d&&(o!=null&&o.sub)){const b=(await y.fetchAll(O=>a.env.data.userOrganizations.listUserOrganizations(d,o.sub,O),"organizations")).map(O=>O.name);if(b.length===0)return r?a.json({tenants:[],start:0,limit:l??50,length:0}):a.json({tenants:[]});const T=b.length,C=c??0,P=l??50,z=C*P,M=b.slice(z,z+P);if(M.length===0)return r?a.json({tenants:[],start:z,limit:P,length:T}):a.json({tenants:[]});const E=M.map(O=>`id:${O}`).join(" OR "),ne=p?`(${E}) AND (${p})`:E,j=await a.env.data.tenants.list({q:ne,per_page:P,include_totals:!1});return r?a.json({tenants:j.tenants,start:z,limit:P,length:T}):a.json({tenants:j.tenants})}const u=await a.env.data.tenants.list({page:c,per_page:l,include_totals:r,q:p});return r?a.json({tenants:u.tenants,start:((h=u.totals)==null?void 0:h.start)??0,limit:((_=u.totals)==null?void 0:_.limit)??l,length:u.tenants.length}):a.json({tenants:u.tenants})}),n.openapi(S.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:y.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:y.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async a=>{var p,o;const s=a.var.user;if(!(s!=null&&s.sub))throw new I(401,{message:"Authentication required to create tenants"});let c=a.req.valid("json");const l={adapters:a.env.data,ctx:a};(p=e.tenants)!=null&&p.beforeCreate&&(c=await e.tenants.beforeCreate(l,c));const r=await a.env.data.tenants.create(c);return(o=e.tenants)!=null&&o.afterCreate&&await e.tenants.afterCreate(l,r),a.json(r,201)}),n.openapi(S.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:S.z.object({id:S.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async a=>{var p,o,i,f;const{id:s}=a.req.valid("param"),c=((p=t.accessControl)==null?void 0:p.controlPlaneTenantId)??((o=a.env.data.multiTenancyConfig)==null?void 0:o.controlPlaneTenantId);if(c){const d=a.var.user;if(!(d!=null&&d.sub))throw new I(401,{message:"Authentication required"});if(s===c)throw new I(403,{message:"Cannot delete the control plane"});if(!(await y.fetchAll(g=>a.env.data.userOrganizations.listUserOrganizations(c,d.sub,g),"organizations")).some(g=>g.name===s))throw new I(403,{message:"Access denied to this tenant"})}if(!await a.env.data.tenants.get(s))throw new I(404,{message:"Tenant not found"});const r={adapters:a.env.data,ctx:a};return(i=e.tenants)!=null&&i.beforeDelete&&await e.tenants.beforeDelete(r,s),await a.env.data.tenants.remove(s),(f=e.tenants)!=null&&f.afterDelete&&await e.tenants.afterDelete(r,s),a.body(null,204)}),n}function de(t){const e=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:a}of e){const s=t.match(n);if(s&&s[1])return{type:a,id:s[1]}}return null}async function ue(t,e,n){try{switch(n.type){case"resource_server":{const a=await t.resourceServers.get(e,n.id);return(a==null?void 0:a.is_system)===!0}case"role":{const a=await t.roles.get(e,n.id);return(a==null?void 0:a.is_system)===!0}case"connection":{const a=await t.connections.get(e,n.id);return(a==null?void 0:a.is_system)===!0}default:return!1}}catch{return!1}}function fe(t){return{resource_server:"resource server",role:"role",connection:"connection"}[t]}function J(){return async(t,e)=>{if(!["PATCH","PUT","DELETE"].includes(t.req.method))return e();const n=de(t.req.path);if(!n)return e();const a=t.var.tenant_id||t.req.header("x-tenant-id")||t.req.header("tenant-id");if(!a)return e();if(await ue(t.env.data,a,n))throw new I(403,{message:`This ${fe(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return e()}}const me=["client_secret","app_secret","twilio_token"];function q(t){if(!t)return t;const e={...t};for(const n of me)delete e[n];return e}function X(t,e){const{controlPlaneTenantId:n,controlPlaneClientId:a,excludeSensitiveFields:s=!1}=e;return{...t,multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:a},legacyClients:{...t.legacyClients,get:async c=>{var d;const l=await t.legacyClients.get(c);if(!l)return null;const r=a?await t.legacyClients.get(a):void 0,p=await t.connections.list(l.tenant.id),o=n?await t.connections.list(n):{connections:[]},i=p.connections.map(u=>{var w;const m=(w=o.connections)==null?void 0:w.find(h=>h.strategy===u.strategy);if(!(m!=null&&m.options))return u;const g=y.connectionSchema.parse({...m||{},...u}),v=s?q(m.options):m.options;return g.options=y.connectionOptionsSchema.parse({...v||{},...u.options}),g}).filter(u=>u),f={...(r==null?void 0:r.tenant)||{},...l.tenant};return!l.tenant.audience&&((d=r==null?void 0:r.tenant)!=null&&d.audience)&&(f.audience=r.tenant.audience),{...l,web_origins:[...(r==null?void 0:r.web_origins)||[],...l.web_origins||[]],allowed_logout_urls:[...(r==null?void 0:r.allowed_logout_urls)||[],...l.allowed_logout_urls||[]],callbacks:[...(r==null?void 0:r.callbacks)||[],...l.callbacks||[]],connections:i,tenant:f}}},connections:{...t.connections,get:async(c,l)=>{var d;const r=await t.connections.get(c,l);if(!r||!n||c===n)return r;const o=(d=(await t.connections.list(n)).connections)==null?void 0:d.find(u=>u.strategy===r.strategy);if(!(o!=null&&o.options))return r;const i=y.connectionSchema.parse({...o,...r}),f=s?q(o.options):o.options;return i.options=y.connectionOptionsSchema.parse({...f||{},...r.options}),i},list:async(c,l)=>{const r=await t.connections.list(c,l);if(!n||c===n)return r;const p=await t.connections.list(n),o=r.connections.map(i=>{var m;const f=(m=p.connections)==null?void 0:m.find(g=>g.strategy===i.strategy);if(!(f!=null&&f.options))return i;const d=y.connectionSchema.parse({...f,...i}),u=s?q(f.options):f.options;return d.options=y.connectionOptionsSchema.parse({...u||{},...i.options}),d});return{...r,connections:o}}}}}function R(t,e){return X(t,e)}function Y(t){return async(e,n)=>{const a=e.var.user;return(a==null?void 0:a.tenant_id)===t&&a.org_name&&e.set("tenant_id",a.org_name),n()}}function Z(t){return async(e,n)=>{if(!t.accessControl)return n();const{controlPlaneTenantId:a}=t.accessControl,s=e.var.org_name,c=e.var.organization_id,l=s||c;let r=e.var.tenant_id;const p=e.var.user,i=(p!=null&&p.aud?Array.isArray(p.aud)?p.aud:[p.aud]:[]).includes(y.MANAGEMENT_API_AUDIENCE);if(!r&&l&&i&&(e.set("tenant_id",l),r=l),!r)throw new I(400,{message:"Tenant ID not found in request"});if(!K(c,r,a,s))throw new I(403,{message:`Access denied to tenant ${r}`});return n()}}function x(t){return async(e,n)=>{if(!t.subdomainRouting)return n();const{baseDomain:a,reservedSubdomains:s=[],resolveSubdomain:c}=t.subdomainRouting,l=e.req.header("host")||"";let r=null;if(l.endsWith(a)){const o=l.slice(0,-(a.length+1));o&&!o.includes(".")&&(r=o)}if(r&&s.includes(r)&&(r=null),!r)return t.accessControl&&e.set("tenant_id",t.accessControl.controlPlaneTenantId),n();let p=null;if(c)p=await c(r);else if(t.subdomainRouting.useOrganizations!==!1&&t.accessControl)try{const o=await e.env.data.organizations.get(t.accessControl.controlPlaneTenantId,r);o&&(p=o.id)}catch{}if(!p)throw new I(404,{message:`Tenant not found for subdomain: ${r}`});return e.set("tenant_id",p),n()}}function ee(t){return async(e,n)=>{if(!t.databaseIsolation)return n();const a=e.var.tenant_id;if(!a)throw new I(400,{message:"Tenant ID not found in request"});try{const s=await t.databaseIsolation.getAdapters(a);e.env.data=s}catch(s){throw console.error(`Failed to resolve database for tenant ${a}:`,s),new I(500,{message:"Failed to resolve tenant database"})}return n()}}function k(t){const e=x(t),n=Z(t),a=ee(t);return async(s,c)=>(await e(s,async()=>{}),await n(s,async()=>{}),await a(s,async()=>{}),c())}function pe(t){const{dataAdapter:e,controlPlane:n,controlPlane:{tenantId:a="control_plane",clientId:s}={},sync:c={resourceServers:!0,roles:!0},defaultPermissions:l=["tenant:admin"],requireOrganizationMatch:r=!1,managementApiExtensions:p=[],entityHooks:o,getChildTenantIds:i,getAdapters:f,...d}=t;let u=e,m=e;n&&(u=R(e,{controlPlaneTenantId:a,controlPlaneClientId:s}),m=R(e,{controlPlaneTenantId:a,controlPlaneClientId:s,excludeSensitiveFields:!0}));const g=c!==!1,v=g?{resourceServers:c.resourceServers??!0,roles:c.roles??!0}:{resourceServers:!1,roles:!1},_={controlPlaneTenantId:a,getChildTenantIds:i??(async()=>(await y.fetchAll(M=>u.tenants.list(M),"tenants",{cursorField:"id",pageSize:100})).filter(M=>M.id!==a).map(M=>M.id)),getAdapters:f??(async()=>u),getControlPlaneAdapters:async()=>u,sync:v},{entityHooks:A,tenantHooks:b}=Q(_),T={resourceServers:[A.resourceServers,...(o==null?void 0:o.resourceServers)??[]],roles:[A.roles,...(o==null?void 0:o.roles)??[]],connections:(o==null?void 0:o.connections)??[],tenants:(o==null?void 0:o.tenants)??[],rolePermissions:(o==null?void 0:o.rolePermissions)??[]},C=$({accessControl:{controlPlaneTenantId:a,requireOrganizationMatch:r,defaultPermissions:l}},{tenants:b}),{app:P}=y.init({dataAdapter:u,managementDataAdapter:m,...d,entityHooks:T,managementApiExtensions:[...p,{path:"/tenants",router:C}]});return P.use("/api/v2/*",Y(a)),g&&P.use("/api/v2/*",J()),{app:P,controlPlaneTenantId:a}}function ge(t){const e=F(t);return{name:"multi-tenancy",middleware:k(t),hooks:e,routes:[{path:"/management",handler:$(t,e)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),t.accessControl&&console.log(`  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`),t.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`),t.databaseIsolation&&console.log("  - Database isolation enabled")}}}function F(t){const e=t.accessControl?B(t.accessControl):{},n=t.databaseIsolation?V(t.databaseIsolation):{},a=W(t);return{...e,...n,tenants:a}}function te(t){const e=new se.Hono,n=F(t);return e.route("/tenants",$(t,n)),e}function we(t){return{hooks:F(t),middleware:k(t),app:te(t),config:t,wrapAdapters:(e,n)=>{var a;return R(e,{controlPlaneTenantId:(a=t.accessControl)==null?void 0:a.controlPlaneTenantId,controlPlaneClientId:n==null?void 0:n.controlPlaneClientId})}}}exports.createAccessControlHooks=B;exports.createAccessControlMiddleware=Z;exports.createControlPlaneTenantMiddleware=Y;exports.createDatabaseHooks=V;exports.createDatabaseMiddleware=ee;exports.createMultiTenancy=te;exports.createMultiTenancyHooks=F;exports.createMultiTenancyMiddleware=k;exports.createMultiTenancyPlugin=ge;exports.createProtectSyncedMiddleware=J;exports.createProvisioningHooks=W;exports.createRuntimeFallbackAdapter=X;exports.createSubdomainMiddleware=x;exports.createSyncHooks=Q;exports.createTenantsOpenAPIRouter=$;exports.initMultiTenant=pe;exports.setupMultiTenancy=we;exports.validateTenantAccess=K;exports.withRuntimeFallback=R;
+"use strict";var re=Object.defineProperty;var ae=(t,e,n)=>e in t?re(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var D=(t,e,n)=>ae(t,typeof e!="symbol"?e+"":e,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const se=require("hono"),y=require("authhero"),I=require("@hono/zod-openapi");function B(t){const{controlPlaneTenantId:e,requireOrganizationMatch:n=!0}=t;return{async onTenantAccessValidation(r,a){if(a===e)return!0;if(n){const c=r.var.org_name,d=r.var.organization_id,s=c||d;return s?s.toLowerCase()===a.toLowerCase():!1}return!0}}}function K(t,e,n,r){if(e===n)return!0;const a=r||t;return a?a.toLowerCase()===e.toLowerCase():!1}function V(t){return{async resolveDataAdapters(e){try{return await t.getAdapters(e)}catch(n){console.error(`Failed to resolve data adapters for tenant ${e}:`,n);return}}}}function oe(t){return`urn:authhero:tenant:${t.toLowerCase()}`}function W(t){return{async beforeCreate(e,n){return!n.audience&&n.id?{...n,audience:oe(n.id)}:n},async afterCreate(e,n){const{accessControl:r,databaseIsolation:a}=t;r&&e.ctx&&await ie(e,n,r),a!=null&&a.onProvision&&await a.onProvision(n.id)},async beforeDelete(e,n){const{accessControl:r,databaseIsolation:a}=t;if(r)try{const d=(await e.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find(s=>s.name===n);d&&await e.adapters.organizations.remove(r.controlPlaneTenantId,d.id)}catch(c){console.warn(`Failed to remove organization for tenant ${n}:`,c)}if(a!=null&&a.onDeprovision)try{await a.onDeprovision(n)}catch(c){console.warn(`Failed to deprovision database for tenant ${n}:`,c)}}}}async function ie(t,e,n){const{controlPlaneTenantId:r,defaultPermissions:a,defaultRoles:c,issuer:d,adminRoleName:s="Tenant Admin",adminRoleDescription:f="Full access to all tenant management operations",addCreatorToOrganization:o=!0}=n,i=await t.adapters.organizations.create(r,{name:e.id,display_name:e.friendly_name||e.id});let u;if(d&&(u=await le(t,r,s,f)),o&&t.ctx){const l=t.ctx.var.user;if(l!=null&&l.sub&&!await ce(t,r,l.sub))try{await t.adapters.userOrganizations.create(r,{user_id:l.sub,organization_id:i.id}),u&&await t.adapters.userRoles.create(r,l.sub,u,i.id)}catch(p){console.warn(`Failed to add creator ${l.sub} to organization ${i.id}:`,p)}}c&&c.length>0&&console.log(`Would assign roles ${c.join(", ")} to organization ${i.id}`),a&&a.length>0&&console.log(`Would grant permissions ${a.join(", ")} to organization ${i.id}`)}async function ce(t,e,n){const r=await t.adapters.userRoles.list(e,n,void 0,"");for(const a of r)if((await t.adapters.rolePermissions.list(e,a.id,{per_page:1e3})).some(s=>s.permission_name==="admin:organizations"))return!0;return!1}async function le(t,e,n,r){const c=(await t.adapters.roles.list(e,{})).roles.find(o=>o.name===n);if(c)return c.id;const d=await t.adapters.roles.create(e,{name:n,description:r}),s=y.MANAGEMENT_API_AUDIENCE,f=y.MANAGEMENT_API_SCOPES.map(o=>({role_id:d.id,resource_server_identifier:s,permission_name:o.value}));return await t.adapters.rolePermissions.assign(e,d.id,f),d.id}function k(t,e,n=()=>!0){const{controlPlaneTenantId:r,getChildTenantIds:a,getAdapters:c}=t,d=new Map;async function s(i,u,l){return(await e(i).list(u,{q:`name:${l}`,per_page:1}))[0]??null}async function f(i){const u=await a(),l=e(await c(r));await Promise.all(u.map(async m=>{try{const p=await c(m),g=e(p),w={...l.transform(i),is_system:!0},h=await s(p,m,i.name),A=h?g.getId(h):void 0;if(h&&A){const P=g.preserveOnUpdate?g.preserveOnUpdate(h,w):w;await g.update(m,A,P)}else await g.create(m,w)}catch(p){console.error(`Failed to sync ${l.listKey} "${i.name}" to tenant "${m}":`,p)}}))}async function o(i){const u=await a();await Promise.all(u.map(async l=>{try{const m=await c(l),p=e(m),g=await s(m,l,i),v=g?p.getId(g):void 0;g&&v&&await p.remove(l,v)}catch(m){console.error(`Failed to delete entity "${i}" from tenant "${l}":`,m)}}))}return{afterCreate:async(i,u)=>{i.tenantId===r&&n(u)&&await f(u)},afterUpdate:async(i,u,l)=>{i.tenantId===r&&n(l)&&await f(l)},beforeDelete:async(i,u)=>{if(i.tenantId!==r)return;const m=await e(i.adapters).get(i.tenantId,u);m&&n(m)&&d.set(u,m)},afterDelete:async(i,u)=>{if(i.tenantId!==r)return;const l=d.get(u);l&&(d.delete(u),await o(l.name))}}}function N(t,e,n=()=>!0){const{controlPlaneTenantId:r,getControlPlaneAdapters:a,getAdapters:c}=t;return{async afterCreate(d,s){if(s.id!==r)try{const f=await a(),o=await c(s.id),i=e(f),u=e(o),l=await y.fetchAll(m=>i.listPaginated(r,m),i.listKey,{cursorField:"id",pageSize:100});await Promise.all(l.filter(m=>n(m)).map(async m=>{try{const p=i.transform(m);await u.create(s.id,{...p,is_system:!0})}catch(p){console.error(`Failed to sync entity to new tenant "${s.id}":`,p)}}))}catch(f){console.error(`Failed to sync entities to new tenant "${s.id}":`,f)}}}}const H=t=>({list:async(e,n)=>(await t.resourceServers.list(e,n)).resource_servers,listPaginated:(e,n)=>t.resourceServers.list(e,n),get:(e,n)=>t.resourceServers.get(e,n),create:(e,n)=>t.resourceServers.create(e,n),update:(e,n,r)=>t.resourceServers.update(e,n,r),remove:(e,n)=>t.resourceServers.remove(e,n),listKey:"resource_servers",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,identifier:e.identifier,scopes:e.scopes,signing_alg:e.signing_alg,token_lifetime:e.token_lifetime,token_lifetime_for_web:e.token_lifetime_for_web})}),G=t=>({list:async(e,n)=>(await t.roles.list(e,n)).roles,listPaginated:(e,n)=>t.roles.list(e,n),get:(e,n)=>t.roles.get(e,n),create:(e,n)=>t.roles.create(e,n),update:(e,n,r)=>t.roles.update(e,n,r),remove:(e,n)=>t.roles.remove(e,n),listKey:"roles",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,description:e.description})});function L(t){var e;return((e=t.metadata)==null?void 0:e.sync)!==!1}function Q(t){const{sync:e={},filters:n={}}=t,r=e.resourceServers??!0,a=e.roles??!0,c=p=>L(p)?n.resourceServers?n.resourceServers(p):!0:!1,d=p=>L(p)?n.roles?n.roles(p):!0:!1,s=r?k(t,H,c):void 0,f=a?k(t,G,d):void 0,o=r?N(t,H,c):void 0,i=a?N(t,G,d):void 0,u=a?{async afterCreate(p,g){var v;if(g.id!==t.controlPlaneTenantId){await((v=i==null?void 0:i.afterCreate)==null?void 0:v.call(i,p,g));try{const w=await t.getControlPlaneAdapters(),h=await t.getAdapters(g.id),A=await y.fetchAll(_=>w.roles.list(t.controlPlaneTenantId,_),"roles",{cursorField:"id",pageSize:100}),P=new Map;for(const _ of A.filter(T=>{var b;return((b=n.roles)==null?void 0:b.call(n,T))??!0})){const T=await l(h,g.id,_.name);T&&P.set(_.name,T.id)}for(const _ of A.filter(T=>{var b;return((b=n.roles)==null?void 0:b.call(n,T))??!0})){const T=P.get(_.name);if(T)try{const b=await w.rolePermissions.list(t.controlPlaneTenantId,_.id,{});b.length>0&&await h.rolePermissions.assign(g.id,T,b.map(C=>({role_id:T,resource_server_identifier:C.resource_server_identifier,permission_name:C.permission_name})))}catch(b){console.error(`Failed to sync permissions for role "${_.name}" to tenant "${g.id}":`,b)}}}catch(w){console.error(`Failed to sync role permissions to tenant "${g.id}":`,w)}}}}:void 0;async function l(p,g,v){return(await p.roles.list(g,{q:`name:${v}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:s,roles:f},tenantHooks:{async afterCreate(p,g){const v=[o==null?void 0:o.afterCreate,(u==null?void 0:u.afterCreate)??(i==null?void 0:i.afterCreate)],w=[];for(const h of v)if(h)try{await h(p,g)}catch(A){w.push(A instanceof Error?A:new Error(String(A)))}if(w.length===1)throw w[0];if(w.length>1)throw new AggregateError(w,w.map(h=>h.message).join("; "))}}}}var S=class extends Error{constructor(e=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});D(this,"res");D(this,"status");this.res=n==null?void 0:n.res,this.status=e}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function $(t,e){const n=new I.OpenAPIHono;return n.openapi(I.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:y.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:I.z.object({tenants:I.z.array(y.tenantSchema),start:I.z.number().optional(),limit:I.z.number().optional(),length:I.z.number().optional()})}},description:"List of tenants"}}}),async r=>{var p,g,v,w,h,A;const a=r.req.valid("query"),{page:c,per_page:d,include_totals:s,q:f}=a,o=r.var.user,i=(o==null?void 0:o.permissions)||[];if(i.includes("auth:read")||i.includes("admin:organizations")){const P=await r.env.data.tenants.list({page:c,per_page:d,include_totals:s,q:f});return s?r.json({tenants:P.tenants,start:((p=P.totals)==null?void 0:p.start)??0,limit:((g=P.totals)==null?void 0:g.limit)??d,length:P.tenants.length}):r.json({tenants:P.tenants})}const l=((v=t.accessControl)==null?void 0:v.controlPlaneTenantId)??((w=r.env.data.multiTenancyConfig)==null?void 0:w.controlPlaneTenantId);if(l&&(o!=null&&o.sub)){const _=(await y.fetchAll(O=>r.env.data.userOrganizations.listUserOrganizations(l,o.sub,O),"organizations")).map(O=>O.name);if(_.length===0)return s?r.json({tenants:[],start:0,limit:d??50,length:0}):r.json({tenants:[]});const T=_.length,b=c??0,C=d??50,z=b*C,M=_.slice(z,z+C);if(M.length===0)return s?r.json({tenants:[],start:z,limit:C,length:T}):r.json({tenants:[]});const E=M.map(O=>`id:${O}`).join(" OR "),ne=f?`(${E}) AND (${f})`:E,j=await r.env.data.tenants.list({q:ne,per_page:C,include_totals:!1});return s?r.json({tenants:j.tenants,start:z,limit:C,length:T}):r.json({tenants:j.tenants})}const m=await r.env.data.tenants.list({page:c,per_page:d,include_totals:s,q:f});return s?r.json({tenants:m.tenants,start:((h=m.totals)==null?void 0:h.start)??0,limit:((A=m.totals)==null?void 0:A.limit)??d,length:m.tenants.length}):r.json({tenants:m.tenants})}),n.openapi(I.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:y.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:y.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async r=>{var f,o;const a=r.var.user;if(!(a!=null&&a.sub))throw new S(401,{message:"Authentication required to create tenants"});let c=r.req.valid("json");const d={adapters:r.env.data,ctx:r};(f=e.tenants)!=null&&f.beforeCreate&&(c=await e.tenants.beforeCreate(d,c));const s=await r.env.data.tenants.create(c);return(o=e.tenants)!=null&&o.afterCreate&&await e.tenants.afterCreate(d,s),r.json(s,201)}),n.openapi(I.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:I.z.object({id:I.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async r=>{var f,o,i,u;const{id:a}=r.req.valid("param"),c=((f=t.accessControl)==null?void 0:f.controlPlaneTenantId)??((o=r.env.data.multiTenancyConfig)==null?void 0:o.controlPlaneTenantId);if(c){const l=r.var.user;if(!(l!=null&&l.sub))throw new S(401,{message:"Authentication required"});if(a===c)throw new S(403,{message:"Cannot delete the control plane"});if(!(await y.fetchAll(g=>r.env.data.userOrganizations.listUserOrganizations(c,l.sub,g),"organizations")).some(g=>g.name===a))throw new S(403,{message:"Access denied to this tenant"})}if(!await r.env.data.tenants.get(a))throw new S(404,{message:"Tenant not found"});const s={adapters:r.env.data,ctx:r};return(i=e.tenants)!=null&&i.beforeDelete&&await e.tenants.beforeDelete(s,a),await r.env.data.tenants.remove(a),(u=e.tenants)!=null&&u.afterDelete&&await e.tenants.afterDelete(s,a),r.body(null,204)}),n}function de(t){const e=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:r}of e){const a=t.match(n);if(a&&a[1])return{type:r,id:a[1]}}return null}async function ue(t,e,n){try{switch(n.type){case"resource_server":{const r=await t.resourceServers.get(e,n.id);return(r==null?void 0:r.is_system)===!0}case"role":{const r=await t.roles.get(e,n.id);return(r==null?void 0:r.is_system)===!0}case"connection":{const r=await t.connections.get(e,n.id);return(r==null?void 0:r.is_system)===!0}default:return!1}}catch{return!1}}function fe(t){return{resource_server:"resource server",role:"role",connection:"connection"}[t]}function J(){return async(t,e)=>{if(!["PATCH","PUT","DELETE"].includes(t.req.method))return e();const n=de(t.req.path);if(!n)return e();const r=t.var.tenant_id||t.req.header("x-tenant-id")||t.req.header("tenant-id");if(!r)return e();if(await ue(t.env.data,r,n))throw new S(403,{message:`This ${fe(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return e()}}const me=["client_secret","app_secret","twilio_token"];function U(t){if(!t)return t;const e={...t};for(const n of me)delete e[n];return e}function X(t,e){const{controlPlaneTenantId:n,controlPlaneClientId:r,excludeSensitiveFields:a=!1}=e;return{...t,multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:r},connections:{...t.connections,get:async(c,d)=>{var l;const s=await t.connections.get(c,d);if(!s||!n||c===n)return s;const o=(l=(await t.connections.list(n)).connections)==null?void 0:l.find(m=>m.strategy===s.strategy);if(!(o!=null&&o.options))return s;const i=y.connectionSchema.parse({...o,...s}),u=a?U(o.options):o.options;return i.options=y.connectionOptionsSchema.parse({...u||{},...s.options}),i},list:async(c,d)=>{const s=await t.connections.list(c,d);if(!n||c===n)return s;const f=await t.connections.list(n),o=s.connections.map(i=>{var p;const u=(p=f.connections)==null?void 0:p.find(g=>g.strategy===i.strategy);if(!(u!=null&&u.options))return i;const l=y.connectionSchema.parse({...u,...i}),m=a?U(u.options):u.options;return l.options=y.connectionOptionsSchema.parse({...m||{},...i.options}),l});return{...s,connections:o}}}}}function R(t,e){return X(t,e)}function Y(t){return async(e,n)=>{const r=e.var.user;return(r==null?void 0:r.tenant_id)===t&&r.org_name&&e.set("tenant_id",r.org_name),n()}}function Z(t){return async(e,n)=>{if(!t.accessControl)return n();const{controlPlaneTenantId:r}=t.accessControl,a=e.var.org_name,c=e.var.organization_id,d=a||c;let s=e.var.tenant_id;const f=e.var.user,i=(f!=null&&f.aud?Array.isArray(f.aud)?f.aud:[f.aud]:[]).includes(y.MANAGEMENT_API_AUDIENCE);if(!s&&d&&i&&(e.set("tenant_id",d),s=d),!s)throw new S(400,{message:"Tenant ID not found in request"});if(!K(c,s,r,a))throw new S(403,{message:`Access denied to tenant ${s}`});return n()}}function x(t){return async(e,n)=>{if(!t.subdomainRouting)return n();const{baseDomain:r,reservedSubdomains:a=[],resolveSubdomain:c}=t.subdomainRouting,d=e.req.header("host")||"";let s=null;if(d.endsWith(r)){const o=d.slice(0,-(r.length+1));o&&!o.includes(".")&&(s=o)}if(s&&a.includes(s)&&(s=null),!s)return t.accessControl&&e.set("tenant_id",t.accessControl.controlPlaneTenantId),n();let f=null;if(c)f=await c(s);else if(t.subdomainRouting.useOrganizations!==!1&&t.accessControl)try{const o=await e.env.data.organizations.get(t.accessControl.controlPlaneTenantId,s);o&&(f=o.id)}catch{}if(!f)throw new S(404,{message:`Tenant not found for subdomain: ${s}`});return e.set("tenant_id",f),n()}}function ee(t){return async(e,n)=>{if(!t.databaseIsolation)return n();const r=e.var.tenant_id;if(!r)throw new S(400,{message:"Tenant ID not found in request"});try{const a=await t.databaseIsolation.getAdapters(r);e.env.data=a}catch(a){throw console.error(`Failed to resolve database for tenant ${r}:`,a),new S(500,{message:"Failed to resolve tenant database"})}return n()}}function q(t){const e=x(t),n=Z(t),r=ee(t);return async(a,c)=>(await e(a,async()=>{}),await n(a,async()=>{}),await r(a,async()=>{}),c())}function pe(t){const{dataAdapter:e,controlPlane:n,controlPlane:{tenantId:r="control_plane",clientId:a}={},sync:c={resourceServers:!0,roles:!0},defaultPermissions:d=["tenant:admin"],requireOrganizationMatch:s=!1,managementApiExtensions:f=[],entityHooks:o,getChildTenantIds:i,getAdapters:u,...l}=t;let m=e,p=e;n&&(m=R(e,{controlPlaneTenantId:r,controlPlaneClientId:a}),p=R(e,{controlPlaneTenantId:r,controlPlaneClientId:a,excludeSensitiveFields:!0}));const g=c!==!1,v=g?{resourceServers:c.resourceServers??!0,roles:c.roles??!0}:{resourceServers:!1,roles:!1},A={controlPlaneTenantId:r,getChildTenantIds:i??(async()=>(await y.fetchAll(M=>m.tenants.list(M),"tenants",{cursorField:"id",pageSize:100})).filter(M=>M.id!==r).map(M=>M.id)),getAdapters:u??(async()=>m),getControlPlaneAdapters:async()=>m,sync:v},{entityHooks:P,tenantHooks:_}=Q(A),T={resourceServers:[P.resourceServers,...(o==null?void 0:o.resourceServers)??[]],roles:[P.roles,...(o==null?void 0:o.roles)??[]],connections:(o==null?void 0:o.connections)??[],tenants:(o==null?void 0:o.tenants)??[],rolePermissions:(o==null?void 0:o.rolePermissions)??[]},b=$({accessControl:{controlPlaneTenantId:r,requireOrganizationMatch:s,defaultPermissions:d}},{tenants:_}),{app:C}=y.init({dataAdapter:m,managementDataAdapter:p,...l,entityHooks:T,managementApiExtensions:[...f,{path:"/tenants",router:b}]});return C.use("/api/v2/*",Y(r)),g&&C.use("/api/v2/*",J()),{app:C,controlPlaneTenantId:r}}function ge(t){const e=F(t);return{name:"multi-tenancy",middleware:q(t),hooks:e,routes:[{path:"/management",handler:$(t,e)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),t.accessControl&&console.log(`  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`),t.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`),t.databaseIsolation&&console.log("  - Database isolation enabled")}}}function F(t){const e=t.accessControl?B(t.accessControl):{},n=t.databaseIsolation?V(t.databaseIsolation):{},r=W(t);return{...e,...n,tenants:r}}function te(t){const e=new se.Hono,n=F(t);return e.route("/tenants",$(t,n)),e}function we(t){return{hooks:F(t),middleware:q(t),app:te(t),config:t,wrapAdapters:(e,n)=>{var r;return R(e,{controlPlaneTenantId:(r=t.accessControl)==null?void 0:r.controlPlaneTenantId,controlPlaneClientId:n==null?void 0:n.controlPlaneClientId})}}}exports.createAccessControlHooks=B;exports.createAccessControlMiddleware=Z;exports.createControlPlaneTenantMiddleware=Y;exports.createDatabaseHooks=V;exports.createDatabaseMiddleware=ee;exports.createMultiTenancy=te;exports.createMultiTenancyHooks=F;exports.createMultiTenancyMiddleware=q;exports.createMultiTenancyPlugin=ge;exports.createProtectSyncedMiddleware=J;exports.createProvisioningHooks=W;exports.createRuntimeFallbackAdapter=X;exports.createSubdomainMiddleware=x;exports.createSyncHooks=Q;exports.createTenantsOpenAPIRouter=$;exports.initMultiTenant=pe;exports.setupMultiTenancy=we;exports.validateTenantAccess=K;exports.withRuntimeFallback=R;

package/dist/multi-tenancy.mjs

@@ -1,24 +1,24 @@
 var X = Object.defineProperty;
 var Y = (t, e, n) => e in t ? X(t, e, { enumerable: !0, configurable: !0, writable: !0, value: n }) : t[e] = n;
-var F = (t, e, n) => Y(t, typeof e != "symbol" ? e + "" : e, n);
+var O = (t, e, n) => Y(t, typeof e != "symbol" ? e + "" : e, n);
 import { Hono as Z } from "hono";
-import { MANAGEMENT_API_SCOPES as x, MANAGEMENT_API_AUDIENCE as W, fetchAll as O, auth0QuerySchema as ee, tenantSchema as G, tenantInsertSchema as te, connectionSchema as R, connectionOptionsSchema as D, init as ne } from "authhero";
-import { OpenAPIHono as re, createRoute as M, z as S } from "@hono/zod-openapi";
-function se(t) {
+import { MANAGEMENT_API_SCOPES as x, MANAGEMENT_API_AUDIENCE as W, fetchAll as F, auth0QuerySchema as ee, tenantSchema as N, tenantInsertSchema as te, connectionSchema as k, connectionOptionsSchema as H, init as ne } from "authhero";
+import { OpenAPIHono as re, createRoute as R, z as S } from "@hono/zod-openapi";
+function ae(t) {
   const { controlPlaneTenantId: e, requireOrganizationMatch: n = !0 } = t;
   return {
     async onTenantAccessValidation(r, a) {
       if (a === e)
         return !0;
       if (n) {
-        const c = r.var.org_name, l = r.var.organization_id, s = c || l;
+        const c = r.var.org_name, d = r.var.organization_id, s = c || d;
         return s ? s.toLowerCase() === a.toLowerCase() : !1;
       }
       return !0;
     }
   };
 }
-function ae(t, e, n, r) {
+function se(t, e, n, r) {
   if (e === n)
     return !0;
   const a = r || t;
@@ -58,12 +58,12 @@ function ce(t) {
       const { accessControl: r, databaseIsolation: a } = t;
       if (r)
         try {
-          const l = (await e.adapters.organizations.list(
+          const d = (await e.adapters.organizations.list(
             r.controlPlaneTenantId
           )).organizations.find((s) => s.name === n);
-          l && await e.adapters.organizations.remove(
+          d && await e.adapters.organizations.remove(
             r.controlPlaneTenantId,
-            l.id
+            d.id
           );
         } catch (c) {
           console.warn(
@@ -88,9 +88,9 @@ async function le(t, e, n) {
     controlPlaneTenantId: r,
     defaultPermissions: a,
     defaultRoles: c,
-    issuer: l,
+    issuer: d,
     adminRoleName: s = "Tenant Admin",
-    adminRoleDescription: p = "Full access to all tenant management operations",
+    adminRoleDescription: f = "Full access to all tenant management operations",
     addCreatorToOrganization: o = !0
   } = n, i = await t.adapters.organizations.create(
     r,
@@ -99,34 +99,34 @@ async function le(t, e, n) {
       display_name: e.friendly_name || e.id
     }
   );
-  let f;
-  if (l && (f = await ue(
+  let u;
+  if (d && (u = await ue(
     t,
     r,
     s,
-    p
+    f
   )), o && t.ctx) {
-    const d = t.ctx.var.user;
-    if (d != null && d.sub && !await de(
+    const l = t.ctx.var.user;
+    if (l != null && l.sub && !await de(
       t,
       r,
-      d.sub
+      l.sub
     ))
       try {
         await t.adapters.userOrganizations.create(r, {
-          user_id: d.sub,
+          user_id: l.sub,
           organization_id: i.id
-        }), f && await t.adapters.userRoles.create(
+        }), u && await t.adapters.userRoles.create(
           r,
-          d.sub,
-          f,
+          l.sub,
+          u,
           i.id
           // organizationId
         );
-      } catch (m) {
+      } catch (p) {
         console.warn(
-          `Failed to add creator ${d.sub} to organization ${i.id}:`,
-          m
+          `Failed to add creator ${l.sub} to organization ${i.id}:`,
+          p
         );
       }
   }
@@ -159,123 +159,123 @@ async function ue(t, e, n, r) {
   const c = (await t.adapters.roles.list(e, {})).roles.find((o) => o.name === n);
   if (c)
     return c.id;
-  const l = await t.adapters.roles.create(e, {
+  const d = await t.adapters.roles.create(e, {
     name: n,
     description: r
-  }), s = W, p = x.map((o) => ({
-    role_id: l.id,
+  }), s = W, f = x.map((o) => ({
+    role_id: d.id,
     resource_server_identifier: s,
     permission_name: o.value
   }));
   return await t.adapters.rolePermissions.assign(
     e,
-    l.id,
-    p
-  ), l.id;
+    d.id,
+    f
+  ), d.id;
 }
-function L(t, e, n = () => !0) {
-  const { controlPlaneTenantId: r, getChildTenantIds: a, getAdapters: c } = t, l = /* @__PURE__ */ new Map();
-  async function s(i, f, d) {
-    return (await e(i).list(f, {
-      q: `name:${d}`,
+function G(t, e, n = () => !0) {
+  const { controlPlaneTenantId: r, getChildTenantIds: a, getAdapters: c } = t, d = /* @__PURE__ */ new Map();
+  async function s(i, u, l) {
+    return (await e(i).list(u, {
+      q: `name:${l}`,
       per_page: 1
     }))[0] ?? null;
   }
-  async function p(i) {
-    const f = await a(), d = e(await c(r));
+  async function f(i) {
+    const u = await a(), l = e(await c(r));
     await Promise.all(
-      f.map(async (u) => {
+      u.map(async (m) => {
         try {
-          const m = await c(u), g = e(m), w = {
-            ...d.transform(i),
+          const p = await c(m), g = e(p), w = {
+            ...l.transform(i),
             is_system: !0
-          }, y = await s(m, u, i.name), _ = y ? g.getId(y) : void 0;
-          if (y && _) {
-            const T = g.preserveOnUpdate ? g.preserveOnUpdate(y, w) : w;
-            await g.update(u, _, T);
+          }, y = await s(p, m, i.name), T = y ? g.getId(y) : void 0;
+          if (y && T) {
+            const A = g.preserveOnUpdate ? g.preserveOnUpdate(y, w) : w;
+            await g.update(m, T, A);
           } else
-            await g.create(u, w);
-        } catch (m) {
+            await g.create(m, w);
+        } catch (p) {
           console.error(
-            `Failed to sync ${d.listKey} "${i.name}" to tenant "${u}":`,
-            m
+            `Failed to sync ${l.listKey} "${i.name}" to tenant "${m}":`,
+            p
           );
         }
       })
     );
   }
   async function o(i) {
-    const f = await a();
+    const u = await a();
     await Promise.all(
-      f.map(async (d) => {
+      u.map(async (l) => {
         try {
-          const u = await c(d), m = e(u), g = await s(u, d, i), h = g ? m.getId(g) : void 0;
-          g && h && await m.remove(d, h);
-        } catch (u) {
+          const m = await c(l), p = e(m), g = await s(m, l, i), h = g ? p.getId(g) : void 0;
+          g && h && await p.remove(l, h);
+        } catch (m) {
           console.error(
-            `Failed to delete entity "${i}" from tenant "${d}":`,
-            u
+            `Failed to delete entity "${i}" from tenant "${l}":`,
+            m
           );
         }
       })
     );
   }
   return {
-    afterCreate: async (i, f) => {
-      i.tenantId === r && n(f) && await p(f);
+    afterCreate: async (i, u) => {
+      i.tenantId === r && n(u) && await f(u);
     },
-    afterUpdate: async (i, f, d) => {
-      i.tenantId === r && n(d) && await p(d);
+    afterUpdate: async (i, u, l) => {
+      i.tenantId === r && n(l) && await f(l);
     },
-    beforeDelete: async (i, f) => {
+    beforeDelete: async (i, u) => {
       if (i.tenantId !== r) return;
-      const u = await e(i.adapters).get(i.tenantId, f);
-      u && n(u) && l.set(f, u);
+      const m = await e(i.adapters).get(i.tenantId, u);
+      m && n(m) && d.set(u, m);
     },
-    afterDelete: async (i, f) => {
+    afterDelete: async (i, u) => {
       if (i.tenantId !== r) return;
-      const d = l.get(f);
-      d && (l.delete(f), await o(d.name));
+      const l = d.get(u);
+      l && (d.delete(u), await o(l.name));
     }
   };
 }
-function U(t, e, n = () => !0) {
+function L(t, e, n = () => !0) {
   const { controlPlaneTenantId: r, getControlPlaneAdapters: a, getAdapters: c } = t;
   return {
-    async afterCreate(l, s) {
+    async afterCreate(d, s) {
       if (s.id !== r)
         try {
-          const p = await a(), o = await c(s.id), i = e(p), f = e(o), d = await O(
-            (u) => i.listPaginated(r, u),
+          const f = await a(), o = await c(s.id), i = e(f), u = e(o), l = await F(
+            (m) => i.listPaginated(r, m),
             i.listKey,
             { cursorField: "id", pageSize: 100 }
           );
           await Promise.all(
-            d.filter((u) => n(u)).map(async (u) => {
+            l.filter((m) => n(m)).map(async (m) => {
               try {
-                const m = i.transform(u);
-                await f.create(s.id, {
-                  ...m,
+                const p = i.transform(m);
+                await u.create(s.id, {
+                  ...p,
                   is_system: !0
                 });
-              } catch (m) {
+              } catch (p) {
                 console.error(
                   `Failed to sync entity to new tenant "${s.id}":`,
-                  m
+                  p
                 );
               }
             })
           );
-        } catch (p) {
+        } catch (f) {
           console.error(
             `Failed to sync entities to new tenant "${s.id}":`,
-            p
+            f
           );
         }
     }
   };
 }
-const B = (t) => ({
+const U = (t) => ({
   list: async (e, n) => (await t.resourceServers.list(e, n)).resource_servers,
   listPaginated: (e, n) => t.resourceServers.list(e, n),
   get: (e, n) => t.resourceServers.get(e, n),
@@ -293,7 +293,7 @@ const B = (t) => ({
     token_lifetime: e.token_lifetime,
     token_lifetime_for_web: e.token_lifetime_for_web
   })
-}), K = (t) => ({
+}), B = (t) => ({
   list: async (e, n) => (await t.roles.list(e, n)).roles,
   listPaginated: (e, n) => t.roles.list(e, n),
   get: (e, n) => t.roles.get(e, n),
@@ -308,81 +308,81 @@ const B = (t) => ({
     description: e.description
   })
 });
-function V(t) {
+function K(t) {
   var e;
   return ((e = t.metadata) == null ? void 0 : e.sync) !== !1;
 }
 function fe(t) {
-  const { sync: e = {}, filters: n = {} } = t, r = e.resourceServers ?? !0, a = e.roles ?? !0, c = (m) => V(m) ? n.resourceServers ? n.resourceServers(m) : !0 : !1, l = (m) => V(m) ? n.roles ? n.roles(m) : !0 : !1, s = r ? L(
+  const { sync: e = {}, filters: n = {} } = t, r = e.resourceServers ?? !0, a = e.roles ?? !0, c = (p) => K(p) ? n.resourceServers ? n.resourceServers(p) : !0 : !1, d = (p) => K(p) ? n.roles ? n.roles(p) : !0 : !1, s = r ? G(
     t,
-    B,
+    U,
     c
-  ) : void 0, p = a ? L(
-    t,
-    K,
-    l
-  ) : void 0, o = r ? U(
+  ) : void 0, f = a ? G(
     t,
     B,
+    d
+  ) : void 0, o = r ? L(
+    t,
+    U,
     c
-  ) : void 0, i = a ? U(
+  ) : void 0, i = a ? L(
     t,
-    K,
-    l
-  ) : void 0, f = a ? {
-    async afterCreate(m, g) {
+    B,
+    d
+  ) : void 0, u = a ? {
+    async afterCreate(p, g) {
       var h;
       if (g.id !== t.controlPlaneTenantId) {
-        await ((h = i == null ? void 0 : i.afterCreate) == null ? void 0 : h.call(i, m, g));
+        await ((h = i == null ? void 0 : i.afterCreate) == null ? void 0 : h.call(i, p, g));
         try {
-          const w = await t.getControlPlaneAdapters(), y = await t.getAdapters(g.id), _ = await O(
-            (A) => w.roles.list(
+          const w = await t.getControlPlaneAdapters(), y = await t.getAdapters(g.id), T = await F(
+            (_) => w.roles.list(
               t.controlPlaneTenantId,
-              A
+              _
             ),
             "roles",
             { cursorField: "id", pageSize: 100 }
-          ), T = /* @__PURE__ */ new Map();
-          for (const A of _.filter(
+          ), A = /* @__PURE__ */ new Map();
+          for (const _ of T.filter(
             (v) => {
-              var b;
-              return ((b = n.roles) == null ? void 0 : b.call(n, v)) ?? !0;
+              var P;
+              return ((P = n.roles) == null ? void 0 : P.call(n, v)) ?? !0;
             }
           )) {
-            const v = await d(
+            const v = await l(
               y,
               g.id,
-              A.name
+              _.name
             );
-            v && T.set(A.name, v.id);
+            v && A.set(_.name, v.id);
           }
-          for (const A of _.filter(
+          for (const _ of T.filter(
             (v) => {
-              var b;
-              return ((b = n.roles) == null ? void 0 : b.call(n, v)) ?? !0;
+              var P;
+              return ((P = n.roles) == null ? void 0 : P.call(n, v)) ?? !0;
             }
           )) {
-            const v = T.get(A.name);
+            const v = A.get(_.name);
             if (v)
               try {
-                const b = await w.rolePermissions.list(
+                const P = await w.rolePermissions.list(
                   t.controlPlaneTenantId,
-                  A.id,
+                  _.id,
                   {}
                 );
-                b.length > 0 && await y.rolePermissions.assign(
+                P.length > 0 && await y.rolePermissions.assign(
                   g.id,
                   v,
-                  b.map((C) => ({
+                  P.map((C) => ({
                     role_id: v,
                     resource_server_identifier: C.resource_server_identifier,
                     permission_name: C.permission_name
                   }))
                 );
-              } catch (b) {
+              } catch (P) {
                 console.error(
-                  `Failed to sync permissions for role "${A.name}" to tenant "${g.id}":`,
-                  b
+                  `Failed to sync permissions for role "${_.name}" to tenant "${g.id}":`,
+                  P
                 );
               }
           }
@@ -395,8 +395,8 @@ function fe(t) {
       }
     }
   } : void 0;
-  async function d(m, g, h) {
-    return (await m.roles.list(g, {
+  async function l(p, g, h) {
+    return (await p.roles.list(g, {
       q: `name:${h}`,
       per_page: 1
     })).roles[0] ?? null;
@@ -404,20 +404,20 @@ function fe(t) {
   return {
     entityHooks: {
       resourceServers: s,
-      roles: p
+      roles: f
     },
     tenantHooks: {
-      async afterCreate(m, g) {
+      async afterCreate(p, g) {
         const h = [
           o == null ? void 0 : o.afterCreate,
-          (f == null ? void 0 : f.afterCreate) ?? (i == null ? void 0 : i.afterCreate)
+          (u == null ? void 0 : u.afterCreate) ?? (i == null ? void 0 : i.afterCreate)
         ], w = [];
         for (const y of h)
           if (y)
             try {
-              await y(m, g);
-            } catch (_) {
-              w.push(_ instanceof Error ? _ : new Error(String(_)));
+              await y(p, g);
+            } catch (T) {
+              w.push(T instanceof Error ? T : new Error(String(T)));
             }
         if (w.length === 1) throw w[0];
         if (w.length > 1)
@@ -429,7 +429,7 @@ function fe(t) {
     }
   };
 }
-var P = class extends Error {
+var b = class extends Error {
   /**
    * Creates an instance of `HTTPException`.
    * @param status - HTTP status code for the exception. Defaults to 500.
@@ -437,8 +437,8 @@ var P = class extends Error {
    */
   constructor(e = 500, n) {
     super(n == null ? void 0 : n.message, { cause: n == null ? void 0 : n.cause });
-    F(this, "res");
-    F(this, "status");
+    O(this, "res");
+    O(this, "status");
     this.res = n == null ? void 0 : n.res, this.status = e;
   }
   /**
@@ -455,10 +455,10 @@ var P = class extends Error {
     });
   }
 };
-function E(t, e) {
+function M(t, e) {
   const n = new re();
   return n.openapi(
-    M({
+    R({
       tags: ["tenants"],
       method: "get",
       path: "/",
@@ -475,7 +475,7 @@ function E(t, e) {
           content: {
             "application/json": {
               schema: S.object({
-                tenants: S.array(G),
+                tenants: S.array(N),
                 start: S.number().optional(),
                 limit: S.number().optional(),
                 length: S.number().optional()
@@ -487,40 +487,40 @@ function E(t, e) {
       }
     }),
     async (r) => {
-      var m, g, h, w, y, _;
-      const a = r.req.valid("query"), { page: c, per_page: l, include_totals: s, q: p } = a, o = r.var.user, i = (o == null ? void 0 : o.permissions) || [];
+      var p, g, h, w, y, T;
+      const a = r.req.valid("query"), { page: c, per_page: d, include_totals: s, q: f } = a, o = r.var.user, i = (o == null ? void 0 : o.permissions) || [];
       if (i.includes("auth:read") || i.includes("admin:organizations")) {
-        const T = await r.env.data.tenants.list({
+        const A = await r.env.data.tenants.list({
           page: c,
-          per_page: l,
+          per_page: d,
           include_totals: s,
-          q: p
+          q: f
         });
         return s ? r.json({
-          tenants: T.tenants,
-          start: ((m = T.totals) == null ? void 0 : m.start) ?? 0,
-          limit: ((g = T.totals) == null ? void 0 : g.limit) ?? l,
-          length: T.tenants.length
-        }) : r.json({ tenants: T.tenants });
+          tenants: A.tenants,
+          start: ((p = A.totals) == null ? void 0 : p.start) ?? 0,
+          limit: ((g = A.totals) == null ? void 0 : g.limit) ?? d,
+          length: A.tenants.length
+        }) : r.json({ tenants: A.tenants });
       }
-      const d = ((h = t.accessControl) == null ? void 0 : h.controlPlaneTenantId) ?? ((w = r.env.data.multiTenancyConfig) == null ? void 0 : w.controlPlaneTenantId);
-      if (d && (o != null && o.sub)) {
-        const A = (await O(
+      const l = ((h = t.accessControl) == null ? void 0 : h.controlPlaneTenantId) ?? ((w = r.env.data.multiTenancyConfig) == null ? void 0 : w.controlPlaneTenantId);
+      if (l && (o != null && o.sub)) {
+        const _ = (await F(
           (z) => r.env.data.userOrganizations.listUserOrganizations(
-            d,
+            l,
             o.sub,
             z
           ),
           "organizations"
         )).map((z) => z.name);
-        if (A.length === 0)
+        if (_.length === 0)
           return s ? r.json({
             tenants: [],
             start: 0,
-            limit: l ?? 50,
+            limit: d ?? 50,
             length: 0
           }) : r.json({ tenants: [] });
-        const v = A.length, b = c ?? 0, C = l ?? 50, $ = b * C, I = A.slice($, $ + C);
+        const v = _.length, P = c ?? 0, C = d ?? 50, $ = P * C, I = _.slice($, $ + C);
         if (I.length === 0)
           return s ? r.json({
             tenants: [],
@@ -528,34 +528,34 @@ function E(t, e) {
             limit: C,
             length: v
           }) : r.json({ tenants: [] });
-        const N = I.map((z) => `id:${z}`).join(" OR "), J = p ? `(${N}) AND (${p})` : N, H = await r.env.data.tenants.list({
+        const j = I.map((z) => `id:${z}`).join(" OR "), J = f ? `(${j}) AND (${f})` : j, E = await r.env.data.tenants.list({
           q: J,
           per_page: C,
           include_totals: !1
           // We calculate totals from accessibleTenantIds
         });
         return s ? r.json({
-          tenants: H.tenants,
+          tenants: E.tenants,
           start: $,
           limit: C,
           length: v
-        }) : r.json({ tenants: H.tenants });
+        }) : r.json({ tenants: E.tenants });
       }
-      const u = await r.env.data.tenants.list({
+      const m = await r.env.data.tenants.list({
         page: c,
-        per_page: l,
+        per_page: d,
         include_totals: s,
-        q: p
+        q: f
       });
       return s ? r.json({
-        tenants: u.tenants,
-        start: ((y = u.totals) == null ? void 0 : y.start) ?? 0,
-        limit: ((_ = u.totals) == null ? void 0 : _.limit) ?? l,
-        length: u.tenants.length
-      }) : r.json({ tenants: u.tenants });
+        tenants: m.tenants,
+        start: ((y = m.totals) == null ? void 0 : y.start) ?? 0,
+        limit: ((T = m.totals) == null ? void 0 : T.limit) ?? d,
+        length: m.tenants.length
+      }) : r.json({ tenants: m.tenants });
     }
   ), n.openapi(
-    M({
+    R({
       tags: ["tenants"],
       method: "post",
       path: "/",
@@ -577,7 +577,7 @@ function E(t, e) {
         201: {
           content: {
             "application/json": {
-              schema: G
+              schema: N
             }
           },
           description: "Tenant created"
@@ -591,23 +591,23 @@ function E(t, e) {
       }
     }),
     async (r) => {
-      var p, o;
+      var f, o;
       const a = r.var.user;
       if (!(a != null && a.sub))
-        throw new P(401, {
+        throw new b(401, {
           message: "Authentication required to create tenants"
         });
       let c = r.req.valid("json");
-      const l = {
+      const d = {
         adapters: r.env.data,
         ctx: r
       };
-      (p = e.tenants) != null && p.beforeCreate && (c = await e.tenants.beforeCreate(l, c));
+      (f = e.tenants) != null && f.beforeCreate && (c = await e.tenants.beforeCreate(d, c));
       const s = await r.env.data.tenants.create(c);
-      return (o = e.tenants) != null && o.afterCreate && await e.tenants.afterCreate(l, s), r.json(s, 201);
+      return (o = e.tenants) != null && o.afterCreate && await e.tenants.afterCreate(d, s), r.json(s, 201);
     }
   ), n.openapi(
-    M({
+    R({
       tags: ["tenants"],
       method: "delete",
       path: "/{id}",
@@ -634,39 +634,39 @@ function E(t, e) {
       }
     }),
     async (r) => {
-      var p, o, i, f;
-      const { id: a } = r.req.valid("param"), c = ((p = t.accessControl) == null ? void 0 : p.controlPlaneTenantId) ?? ((o = r.env.data.multiTenancyConfig) == null ? void 0 : o.controlPlaneTenantId);
+      var f, o, i, u;
+      const { id: a } = r.req.valid("param"), c = ((f = t.accessControl) == null ? void 0 : f.controlPlaneTenantId) ?? ((o = r.env.data.multiTenancyConfig) == null ? void 0 : o.controlPlaneTenantId);
       if (c) {
-        const d = r.var.user;
-        if (!(d != null && d.sub))
-          throw new P(401, {
+        const l = r.var.user;
+        if (!(l != null && l.sub))
+          throw new b(401, {
             message: "Authentication required"
           });
         if (a === c)
-          throw new P(403, {
+          throw new b(403, {
             message: "Cannot delete the control plane"
           });
-        if (!(await O(
+        if (!(await F(
           (g) => r.env.data.userOrganizations.listUserOrganizations(
             c,
-            d.sub,
+            l.sub,
             g
           ),
           "organizations"
         )).some((g) => g.name === a))
-          throw new P(403, {
+          throw new b(403, {
             message: "Access denied to this tenant"
           });
       }
       if (!await r.env.data.tenants.get(a))
-        throw new P(404, {
+        throw new b(404, {
           message: "Tenant not found"
         });
       const s = {
         adapters: r.env.data,
         ctx: r
       };
-      return (i = e.tenants) != null && i.beforeDelete && await e.tenants.beforeDelete(s, a), await r.env.data.tenants.remove(a), (f = e.tenants) != null && f.afterDelete && await e.tenants.afterDelete(s, a), r.body(null, 204);
+      return (i = e.tenants) != null && i.beforeDelete && await e.tenants.beforeDelete(s, a), await r.env.data.tenants.remove(a), (u = e.tenants) != null && u.afterDelete && await e.tenants.afterDelete(s, a), r.body(null, 204);
     }
   ), n;
 }
@@ -726,7 +726,7 @@ function we() {
     if (!r)
       return e();
     if (await pe(t.env.data, r, n))
-      throw new P(403, {
+      throw new b(403, {
         message: `This ${ge(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return e();
@@ -737,7 +737,7 @@ const ye = [
   "app_secret",
   "twilio_token"
 ];
-function q(t) {
+function V(t) {
   if (!t) return t;
   const e = { ...t };
   for (const n of ye)
@@ -757,96 +757,49 @@ function he(t, e) {
       controlPlaneTenantId: n,
       controlPlaneClientId: r
     },
-    legacyClients: {
-      ...t.legacyClients,
-      get: async (c) => {
-        var d;
-        const l = await t.legacyClients.get(c);
-        if (!l)
-          return null;
-        const s = r ? await t.legacyClients.get(r) : void 0, p = await t.connections.list(
-          l.tenant.id
-        ), o = n ? await t.connections.list(n) : { connections: [] }, i = p.connections.map((u) => {
-          var w;
-          const m = (w = o.connections) == null ? void 0 : w.find(
-            (y) => y.strategy === u.strategy
-          );
-          if (!(m != null && m.options))
-            return u;
-          const g = R.parse({
-            ...m || {},
-            ...u
-          }), h = a ? q(m.options) : m.options;
-          return g.options = D.parse({
-            ...h || {},
-            ...u.options
-          }), g;
-        }).filter((u) => u), f = {
-          ...(s == null ? void 0 : s.tenant) || {},
-          ...l.tenant
-        };
-        return !l.tenant.audience && ((d = s == null ? void 0 : s.tenant) != null && d.audience) && (f.audience = s.tenant.audience), {
-          ...l,
-          web_origins: [
-            ...(s == null ? void 0 : s.web_origins) || [],
-            ...l.web_origins || []
-          ],
-          allowed_logout_urls: [
-            ...(s == null ? void 0 : s.allowed_logout_urls) || [],
-            ...l.allowed_logout_urls || []
-          ],
-          callbacks: [
-            ...(s == null ? void 0 : s.callbacks) || [],
-            ...l.callbacks || []
-          ],
-          connections: i,
-          tenant: f
-        };
-      }
-    },
     connections: {
       ...t.connections,
-      get: async (c, l) => {
-        var d;
+      get: async (c, d) => {
+        var l;
         const s = await t.connections.get(
           c,
-          l
+          d
         );
         if (!s || !n || c === n)
           return s;
-        const o = (d = (await t.connections.list(n)).connections) == null ? void 0 : d.find(
-          (u) => u.strategy === s.strategy
+        const o = (l = (await t.connections.list(n)).connections) == null ? void 0 : l.find(
+          (m) => m.strategy === s.strategy
         );
         if (!(o != null && o.options))
           return s;
-        const i = R.parse({
+        const i = k.parse({
           ...o,
           ...s
-        }), f = a ? q(o.options) : o.options;
-        return i.options = D.parse({
-          ...f || {},
+        }), u = a ? V(o.options) : o.options;
+        return i.options = H.parse({
+          ...u || {},
           ...s.options
         }), i;
       },
-      list: async (c, l) => {
-        const s = await t.connections.list(c, l);
+      list: async (c, d) => {
+        const s = await t.connections.list(c, d);
         if (!n || c === n)
           return s;
-        const p = await t.connections.list(n), o = s.connections.map((i) => {
-          var m;
-          const f = (m = p.connections) == null ? void 0 : m.find(
+        const f = await t.connections.list(n), o = s.connections.map((i) => {
+          var p;
+          const u = (p = f.connections) == null ? void 0 : p.find(
             (g) => g.strategy === i.strategy
           );
-          if (!(f != null && f.options))
+          if (!(u != null && u.options))
             return i;
-          const d = R.parse({
-            ...f,
+          const l = k.parse({
+            ...u,
             ...i
-          }), u = a ? q(f.options) : f.options;
-          return d.options = D.parse({
-            ...u || {},
+          }), m = a ? V(u.options) : u.options;
+          return l.options = H.parse({
+            ...m || {},
             ...i.options
-          }), d;
+          }), l;
         });
         return {
           ...s,
@@ -863,7 +816,7 @@ function he(t, e) {
     // They remain part of ...baseAdapters and can be properly wrapped by caching.
   };
 }
-function j(t, e) {
+function D(t, e) {
   return he(t, e);
 }
 function ve(t) {
@@ -872,30 +825,30 @@ function ve(t) {
     return (r == null ? void 0 : r.tenant_id) === t && r.org_name && e.set("tenant_id", r.org_name), n();
   };
 }
-function _e(t) {
+function Te(t) {
   return async (e, n) => {
     if (!t.accessControl)
       return n();
-    const { controlPlaneTenantId: r } = t.accessControl, a = e.var.org_name, c = e.var.organization_id, l = a || c;
+    const { controlPlaneTenantId: r } = t.accessControl, a = e.var.org_name, c = e.var.organization_id, d = a || c;
     let s = e.var.tenant_id;
-    const p = e.var.user, i = (p != null && p.aud ? Array.isArray(p.aud) ? p.aud : [p.aud] : []).includes(W);
-    if (!s && l && i && (e.set("tenant_id", l), s = l), !s)
-      throw new P(400, {
+    const f = e.var.user, i = (f != null && f.aud ? Array.isArray(f.aud) ? f.aud : [f.aud] : []).includes(W);
+    if (!s && d && i && (e.set("tenant_id", d), s = d), !s)
+      throw new b(400, {
         message: "Tenant ID not found in request"
       });
-    if (!ae(
+    if (!se(
       c,
       s,
       r,
       a
     ))
-      throw new P(403, {
+      throw new b(403, {
         message: `Access denied to tenant ${s}`
       });
     return n();
   };
 }
-function Te(t) {
+function Ae(t) {
   return async (e, n) => {
     if (!t.subdomainRouting)
       return n();
@@ -903,40 +856,40 @@ function Te(t) {
       baseDomain: r,
       reservedSubdomains: a = [],
       resolveSubdomain: c
-    } = t.subdomainRouting, l = e.req.header("host") || "";
+    } = t.subdomainRouting, d = e.req.header("host") || "";
     let s = null;
-    if (l.endsWith(r)) {
-      const o = l.slice(0, -(r.length + 1));
+    if (d.endsWith(r)) {
+      const o = d.slice(0, -(r.length + 1));
       o && !o.includes(".") && (s = o);
     }
     if (s && a.includes(s) && (s = null), !s)
       return t.accessControl && e.set("tenant_id", t.accessControl.controlPlaneTenantId), n();
-    let p = null;
+    let f = null;
     if (c)
-      p = await c(s);
+      f = await c(s);
     else if (t.subdomainRouting.useOrganizations !== !1 && t.accessControl)
       try {
         const o = await e.env.data.organizations.get(
           t.accessControl.controlPlaneTenantId,
           s
         );
-        o && (p = o.id);
+        o && (f = o.id);
       } catch {
       }
-    if (!p)
-      throw new P(404, {
+    if (!f)
+      throw new b(404, {
         message: `Tenant not found for subdomain: ${s}`
       });
-    return e.set("tenant_id", p), n();
+    return e.set("tenant_id", f), n();
   };
 }
-function Ae(t) {
+function _e(t) {
   return async (e, n) => {
     if (!t.databaseIsolation)
       return n();
     const r = e.var.tenant_id;
     if (!r)
-      throw new P(400, {
+      throw new b(400, {
         message: "Tenant ID not found in request"
       });
     try {
@@ -946,7 +899,7 @@ function Ae(t) {
       throw console.error(
         `Failed to resolve database for tenant ${r}:`,
         a
-      ), new P(500, {
+      ), new b(500, {
         message: "Failed to resolve tenant database"
       });
     }
@@ -954,7 +907,7 @@ function Ae(t) {
   };
 }
 function Q(t) {
-  const e = Te(t), n = _e(t), r = Ae(t);
+  const e = Ae(t), n = Te(t), r = _e(t);
   return async (a, c) => (await e(a, async () => {
   }), await n(a, async () => {
   }), await r(a, async () => {
@@ -969,19 +922,19 @@ function $e(t) {
       clientId: a
     } = {},
     sync: c = { resourceServers: !0, roles: !0 },
-    defaultPermissions: l = ["tenant:admin"],
+    defaultPermissions: d = ["tenant:admin"],
     requireOrganizationMatch: s = !1,
-    managementApiExtensions: p = [],
+    managementApiExtensions: f = [],
     entityHooks: o,
     getChildTenantIds: i,
-    getAdapters: f,
-    ...d
+    getAdapters: u,
+    ...l
   } = t;
-  let u = e, m = e;
-  n && (u = j(e, {
+  let m = e, p = e;
+  n && (m = D(e, {
     controlPlaneTenantId: r,
     controlPlaneClientId: a
-  }), m = j(e, {
+  }), p = D(e, {
     controlPlaneTenantId: r,
     controlPlaneClientId: a,
     excludeSensitiveFields: !0
@@ -989,48 +942,48 @@ function $e(t) {
   const g = c !== !1, h = g ? {
     resourceServers: c.resourceServers ?? !0,
     roles: c.roles ?? !0
-  } : { resourceServers: !1, roles: !1 }, _ = {
+  } : { resourceServers: !1, roles: !1 }, T = {
     controlPlaneTenantId: r,
-    getChildTenantIds: i ?? (async () => (await O(
-      (I) => u.tenants.list(I),
+    getChildTenantIds: i ?? (async () => (await F(
+      (I) => m.tenants.list(I),
       "tenants",
       { cursorField: "id", pageSize: 100 }
     )).filter((I) => I.id !== r).map((I) => I.id)),
-    getAdapters: f ?? (async () => u),
-    getControlPlaneAdapters: async () => u,
+    getAdapters: u ?? (async () => m),
+    getControlPlaneAdapters: async () => m,
     sync: h
-  }, { entityHooks: T, tenantHooks: A } = fe(_), v = {
+  }, { entityHooks: A, tenantHooks: _ } = fe(T), v = {
     resourceServers: [
-      T.resourceServers,
+      A.resourceServers,
       ...(o == null ? void 0 : o.resourceServers) ?? []
     ],
-    roles: [T.roles, ...(o == null ? void 0 : o.roles) ?? []],
+    roles: [A.roles, ...(o == null ? void 0 : o.roles) ?? []],
     connections: (o == null ? void 0 : o.connections) ?? [],
     tenants: (o == null ? void 0 : o.tenants) ?? [],
     rolePermissions: (o == null ? void 0 : o.rolePermissions) ?? []
-  }, b = E(
+  }, P = M(
     {
       accessControl: {
         controlPlaneTenantId: r,
         requireOrganizationMatch: s,
-        defaultPermissions: l
+        defaultPermissions: d
       }
     },
-    { tenants: A }
+    { tenants: _ }
   ), { app: C } = ne({
-    dataAdapter: u,
-    managementDataAdapter: m,
-    ...d,
+    dataAdapter: m,
+    managementDataAdapter: p,
+    ...l,
     entityHooks: v,
     managementApiExtensions: [
-      ...p,
-      { path: "/tenants", router: b }
+      ...f,
+      { path: "/tenants", router: P }
     ]
   });
   return C.use("/api/v2/*", ve(r)), g && C.use("/api/v2/*", we()), { app: C, controlPlaneTenantId: r };
 }
 function ze(t) {
-  const e = k(t);
+  const e = q(t);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
@@ -1041,7 +994,7 @@ function ze(t) {
     routes: [
       {
         path: "/management",
-        handler: E(t, e)
+        handler: M(t, e)
       }
     ],
     // Called when plugin is registered
@@ -1054,23 +1007,23 @@ function ze(t) {
     }
   };
 }
-function k(t) {
-  const e = t.accessControl ? se(t.accessControl) : {}, n = t.databaseIsolation ? oe(t.databaseIsolation) : {}, r = ce(t);
+function q(t) {
+  const e = t.accessControl ? ae(t.accessControl) : {}, n = t.databaseIsolation ? oe(t.databaseIsolation) : {}, r = ce(t);
   return {
     ...e,
     ...n,
     tenants: r
   };
 }
-function be(t) {
-  const e = new Z(), n = k(t);
-  return e.route("/tenants", E(t, n)), e;
+function Pe(t) {
+  const e = new Z(), n = q(t);
+  return e.route("/tenants", M(t, n)), e;
 }
-function Oe(t) {
+function Fe(t) {
   return {
-    hooks: k(t),
+    hooks: q(t),
     middleware: Q(t),
-    app: be(t),
+    app: Pe(t),
     config: t,
     /**
      * Wraps data adapters with runtime fallback from the control plane.
@@ -1082,7 +1035,7 @@ function Oe(t) {
      */
     wrapAdapters: (e, n) => {
       var r;
-      return j(e, {
+      return D(e, {
         controlPlaneTenantId: (r = t.accessControl) == null ? void 0 : r.controlPlaneTenantId,
         controlPlaneClientId: n == null ? void 0 : n.controlPlaneClientId
       });
@@ -1090,23 +1043,23 @@ function Oe(t) {
   };
 }
 export {
-  se as createAccessControlHooks,
-  _e as createAccessControlMiddleware,
+  ae as createAccessControlHooks,
+  Te as createAccessControlMiddleware,
   ve as createControlPlaneTenantMiddleware,
   oe as createDatabaseHooks,
-  Ae as createDatabaseMiddleware,
-  be as createMultiTenancy,
-  k as createMultiTenancyHooks,
+  _e as createDatabaseMiddleware,
+  Pe as createMultiTenancy,
+  q as createMultiTenancyHooks,
   Q as createMultiTenancyMiddleware,
   ze as createMultiTenancyPlugin,
   we as createProtectSyncedMiddleware,
   ce as createProvisioningHooks,
   he as createRuntimeFallbackAdapter,
-  Te as createSubdomainMiddleware,
+  Ae as createSubdomainMiddleware,
   fe as createSyncHooks,
-  E as createTenantsOpenAPIRouter,
+  M as createTenantsOpenAPIRouter,
   $e as initMultiTenant,
-  Oe as setupMultiTenancy,
-  ae as validateTenantAccess,
-  j as withRuntimeFallback
+  Fe as setupMultiTenancy,
+  se as validateTenantAccess,
+  D as withRuntimeFallback
 };

package/dist/types/middleware/settings-inheritance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAKb,MAAM,UAAU,CAAC;AA+BlB;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAmNd;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}
+{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAIb,MAAM,UAAU,CAAC;AA+BlB;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CA0Hd;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "14.6.0",
+  "version": "14.7.0",
   "description": "Multi-tenancy support for AuthHero with organization-based access control and per-tenant database isolation",
   "files": [
     "dist"
@@ -36,9 +36,9 @@
     "typescript": "^5.6.0",
     "vite": "^6.0.0",
     "vitest": "^2.1.0",
-    "authhero": "4.12.0",
-    "@authhero/adapter-interfaces": "0.122.0",
-    "@authhero/kysely-adapter": "10.83.0"
+    "@authhero/kysely-adapter": "10.88.0",
+    "authhero": "4.23.0",
+    "@authhero/adapter-interfaces": "0.127.0"
   },
   "dependencies": {
     "zod": "^3.24.0"