@authhero/multi-tenancy 14.7.0 → 14.8.0

package/dist/multi-tenancy.cjs

@@ -1 +1 @@
-"use strict";var re=Object.defineProperty;var ae=(t,e,n)=>e in t?re(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var D=(t,e,n)=>ae(t,typeof e!="symbol"?e+"":e,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const se=require("hono"),y=require("authhero"),I=require("@hono/zod-openapi");function B(t){const{controlPlaneTenantId:e,requireOrganizationMatch:n=!0}=t;return{async onTenantAccessValidation(r,a){if(a===e)return!0;if(n){const c=r.var.org_name,d=r.var.organization_id,s=c||d;return s?s.toLowerCase()===a.toLowerCase():!1}return!0}}}function K(t,e,n,r){if(e===n)return!0;const a=r||t;return a?a.toLowerCase()===e.toLowerCase():!1}function V(t){return{async resolveDataAdapters(e){try{return await t.getAdapters(e)}catch(n){console.error(`Failed to resolve data adapters for tenant ${e}:`,n);return}}}}function oe(t){return`urn:authhero:tenant:${t.toLowerCase()}`}function W(t){return{async beforeCreate(e,n){return!n.audience&&n.id?{...n,audience:oe(n.id)}:n},async afterCreate(e,n){const{accessControl:r,databaseIsolation:a}=t;r&&e.ctx&&await ie(e,n,r),a!=null&&a.onProvision&&await a.onProvision(n.id)},async beforeDelete(e,n){const{accessControl:r,databaseIsolation:a}=t;if(r)try{const d=(await e.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find(s=>s.name===n);d&&await e.adapters.organizations.remove(r.controlPlaneTenantId,d.id)}catch(c){console.warn(`Failed to remove organization for tenant ${n}:`,c)}if(a!=null&&a.onDeprovision)try{await a.onDeprovision(n)}catch(c){console.warn(`Failed to deprovision database for tenant ${n}:`,c)}}}}async function ie(t,e,n){const{controlPlaneTenantId:r,defaultPermissions:a,defaultRoles:c,issuer:d,adminRoleName:s="Tenant Admin",adminRoleDescription:f="Full access to all tenant management operations",addCreatorToOrganization:o=!0}=n,i=await t.adapters.organizations.create(r,{name:e.id,display_name:e.friendly_name||e.id});let u;if(d&&(u=await le(t,r,s,f)),o&&t.ctx){const l=t.ctx.var.user;if(l!=null&&l.sub&&!await ce(t,r,l.sub))try{await t.adapters.userOrganizations.create(r,{user_id:l.sub,organization_id:i.id}),u&&await t.adapters.userRoles.create(r,l.sub,u,i.id)}catch(p){console.warn(`Failed to add creator ${l.sub} to organization ${i.id}:`,p)}}c&&c.length>0&&console.log(`Would assign roles ${c.join(", ")} to organization ${i.id}`),a&&a.length>0&&console.log(`Would grant permissions ${a.join(", ")} to organization ${i.id}`)}async function ce(t,e,n){const r=await t.adapters.userRoles.list(e,n,void 0,"");for(const a of r)if((await t.adapters.rolePermissions.list(e,a.id,{per_page:1e3})).some(s=>s.permission_name==="admin:organizations"))return!0;return!1}async function le(t,e,n,r){const c=(await t.adapters.roles.list(e,{})).roles.find(o=>o.name===n);if(c)return c.id;const d=await t.adapters.roles.create(e,{name:n,description:r}),s=y.MANAGEMENT_API_AUDIENCE,f=y.MANAGEMENT_API_SCOPES.map(o=>({role_id:d.id,resource_server_identifier:s,permission_name:o.value}));return await t.adapters.rolePermissions.assign(e,d.id,f),d.id}function k(t,e,n=()=>!0){const{controlPlaneTenantId:r,getChildTenantIds:a,getAdapters:c}=t,d=new Map;async function s(i,u,l){return(await e(i).list(u,{q:`name:${l}`,per_page:1}))[0]??null}async function f(i){const u=await a(),l=e(await c(r));await Promise.all(u.map(async m=>{try{const p=await c(m),g=e(p),w={...l.transform(i),is_system:!0},h=await s(p,m,i.name),A=h?g.getId(h):void 0;if(h&&A){const P=g.preserveOnUpdate?g.preserveOnUpdate(h,w):w;await g.update(m,A,P)}else await g.create(m,w)}catch(p){console.error(`Failed to sync ${l.listKey} "${i.name}" to tenant "${m}":`,p)}}))}async function o(i){const u=await a();await Promise.all(u.map(async l=>{try{const m=await c(l),p=e(m),g=await s(m,l,i),v=g?p.getId(g):void 0;g&&v&&await p.remove(l,v)}catch(m){console.error(`Failed to delete entity "${i}" from tenant "${l}":`,m)}}))}return{afterCreate:async(i,u)=>{i.tenantId===r&&n(u)&&await f(u)},afterUpdate:async(i,u,l)=>{i.tenantId===r&&n(l)&&await f(l)},beforeDelete:async(i,u)=>{if(i.tenantId!==r)return;const m=await e(i.adapters).get(i.tenantId,u);m&&n(m)&&d.set(u,m)},afterDelete:async(i,u)=>{if(i.tenantId!==r)return;const l=d.get(u);l&&(d.delete(u),await o(l.name))}}}function N(t,e,n=()=>!0){const{controlPlaneTenantId:r,getControlPlaneAdapters:a,getAdapters:c}=t;return{async afterCreate(d,s){if(s.id!==r)try{const f=await a(),o=await c(s.id),i=e(f),u=e(o),l=await y.fetchAll(m=>i.listPaginated(r,m),i.listKey,{cursorField:"id",pageSize:100});await Promise.all(l.filter(m=>n(m)).map(async m=>{try{const p=i.transform(m);await u.create(s.id,{...p,is_system:!0})}catch(p){console.error(`Failed to sync entity to new tenant "${s.id}":`,p)}}))}catch(f){console.error(`Failed to sync entities to new tenant "${s.id}":`,f)}}}}const H=t=>({list:async(e,n)=>(await t.resourceServers.list(e,n)).resource_servers,listPaginated:(e,n)=>t.resourceServers.list(e,n),get:(e,n)=>t.resourceServers.get(e,n),create:(e,n)=>t.resourceServers.create(e,n),update:(e,n,r)=>t.resourceServers.update(e,n,r),remove:(e,n)=>t.resourceServers.remove(e,n),listKey:"resource_servers",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,identifier:e.identifier,scopes:e.scopes,signing_alg:e.signing_alg,token_lifetime:e.token_lifetime,token_lifetime_for_web:e.token_lifetime_for_web})}),G=t=>({list:async(e,n)=>(await t.roles.list(e,n)).roles,listPaginated:(e,n)=>t.roles.list(e,n),get:(e,n)=>t.roles.get(e,n),create:(e,n)=>t.roles.create(e,n),update:(e,n,r)=>t.roles.update(e,n,r),remove:(e,n)=>t.roles.remove(e,n),listKey:"roles",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,description:e.description})});function L(t){var e;return((e=t.metadata)==null?void 0:e.sync)!==!1}function Q(t){const{sync:e={},filters:n={}}=t,r=e.resourceServers??!0,a=e.roles??!0,c=p=>L(p)?n.resourceServers?n.resourceServers(p):!0:!1,d=p=>L(p)?n.roles?n.roles(p):!0:!1,s=r?k(t,H,c):void 0,f=a?k(t,G,d):void 0,o=r?N(t,H,c):void 0,i=a?N(t,G,d):void 0,u=a?{async afterCreate(p,g){var v;if(g.id!==t.controlPlaneTenantId){await((v=i==null?void 0:i.afterCreate)==null?void 0:v.call(i,p,g));try{const w=await t.getControlPlaneAdapters(),h=await t.getAdapters(g.id),A=await y.fetchAll(_=>w.roles.list(t.controlPlaneTenantId,_),"roles",{cursorField:"id",pageSize:100}),P=new Map;for(const _ of A.filter(T=>{var b;return((b=n.roles)==null?void 0:b.call(n,T))??!0})){const T=await l(h,g.id,_.name);T&&P.set(_.name,T.id)}for(const _ of A.filter(T=>{var b;return((b=n.roles)==null?void 0:b.call(n,T))??!0})){const T=P.get(_.name);if(T)try{const b=await w.rolePermissions.list(t.controlPlaneTenantId,_.id,{});b.length>0&&await h.rolePermissions.assign(g.id,T,b.map(C=>({role_id:T,resource_server_identifier:C.resource_server_identifier,permission_name:C.permission_name})))}catch(b){console.error(`Failed to sync permissions for role "${_.name}" to tenant "${g.id}":`,b)}}}catch(w){console.error(`Failed to sync role permissions to tenant "${g.id}":`,w)}}}}:void 0;async function l(p,g,v){return(await p.roles.list(g,{q:`name:${v}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:s,roles:f},tenantHooks:{async afterCreate(p,g){const v=[o==null?void 0:o.afterCreate,(u==null?void 0:u.afterCreate)??(i==null?void 0:i.afterCreate)],w=[];for(const h of v)if(h)try{await h(p,g)}catch(A){w.push(A instanceof Error?A:new Error(String(A)))}if(w.length===1)throw w[0];if(w.length>1)throw new AggregateError(w,w.map(h=>h.message).join("; "))}}}}var S=class extends Error{constructor(e=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});D(this,"res");D(this,"status");this.res=n==null?void 0:n.res,this.status=e}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function $(t,e){const n=new I.OpenAPIHono;return n.openapi(I.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:y.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:I.z.object({tenants:I.z.array(y.tenantSchema),start:I.z.number().optional(),limit:I.z.number().optional(),length:I.z.number().optional()})}},description:"List of tenants"}}}),async r=>{var p,g,v,w,h,A;const a=r.req.valid("query"),{page:c,per_page:d,include_totals:s,q:f}=a,o=r.var.user,i=(o==null?void 0:o.permissions)||[];if(i.includes("auth:read")||i.includes("admin:organizations")){const P=await r.env.data.tenants.list({page:c,per_page:d,include_totals:s,q:f});return s?r.json({tenants:P.tenants,start:((p=P.totals)==null?void 0:p.start)??0,limit:((g=P.totals)==null?void 0:g.limit)??d,length:P.tenants.length}):r.json({tenants:P.tenants})}const l=((v=t.accessControl)==null?void 0:v.controlPlaneTenantId)??((w=r.env.data.multiTenancyConfig)==null?void 0:w.controlPlaneTenantId);if(l&&(o!=null&&o.sub)){const _=(await y.fetchAll(O=>r.env.data.userOrganizations.listUserOrganizations(l,o.sub,O),"organizations")).map(O=>O.name);if(_.length===0)return s?r.json({tenants:[],start:0,limit:d??50,length:0}):r.json({tenants:[]});const T=_.length,b=c??0,C=d??50,z=b*C,M=_.slice(z,z+C);if(M.length===0)return s?r.json({tenants:[],start:z,limit:C,length:T}):r.json({tenants:[]});const E=M.map(O=>`id:${O}`).join(" OR "),ne=f?`(${E}) AND (${f})`:E,j=await r.env.data.tenants.list({q:ne,per_page:C,include_totals:!1});return s?r.json({tenants:j.tenants,start:z,limit:C,length:T}):r.json({tenants:j.tenants})}const m=await r.env.data.tenants.list({page:c,per_page:d,include_totals:s,q:f});return s?r.json({tenants:m.tenants,start:((h=m.totals)==null?void 0:h.start)??0,limit:((A=m.totals)==null?void 0:A.limit)??d,length:m.tenants.length}):r.json({tenants:m.tenants})}),n.openapi(I.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:y.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:y.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async r=>{var f,o;const a=r.var.user;if(!(a!=null&&a.sub))throw new S(401,{message:"Authentication required to create tenants"});let c=r.req.valid("json");const d={adapters:r.env.data,ctx:r};(f=e.tenants)!=null&&f.beforeCreate&&(c=await e.tenants.beforeCreate(d,c));const s=await r.env.data.tenants.create(c);return(o=e.tenants)!=null&&o.afterCreate&&await e.tenants.afterCreate(d,s),r.json(s,201)}),n.openapi(I.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:I.z.object({id:I.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async r=>{var f,o,i,u;const{id:a}=r.req.valid("param"),c=((f=t.accessControl)==null?void 0:f.controlPlaneTenantId)??((o=r.env.data.multiTenancyConfig)==null?void 0:o.controlPlaneTenantId);if(c){const l=r.var.user;if(!(l!=null&&l.sub))throw new S(401,{message:"Authentication required"});if(a===c)throw new S(403,{message:"Cannot delete the control plane"});if(!(await y.fetchAll(g=>r.env.data.userOrganizations.listUserOrganizations(c,l.sub,g),"organizations")).some(g=>g.name===a))throw new S(403,{message:"Access denied to this tenant"})}if(!await r.env.data.tenants.get(a))throw new S(404,{message:"Tenant not found"});const s={adapters:r.env.data,ctx:r};return(i=e.tenants)!=null&&i.beforeDelete&&await e.tenants.beforeDelete(s,a),await r.env.data.tenants.remove(a),(u=e.tenants)!=null&&u.afterDelete&&await e.tenants.afterDelete(s,a),r.body(null,204)}),n}function de(t){const e=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:r}of e){const a=t.match(n);if(a&&a[1])return{type:r,id:a[1]}}return null}async function ue(t,e,n){try{switch(n.type){case"resource_server":{const r=await t.resourceServers.get(e,n.id);return(r==null?void 0:r.is_system)===!0}case"role":{const r=await t.roles.get(e,n.id);return(r==null?void 0:r.is_system)===!0}case"connection":{const r=await t.connections.get(e,n.id);return(r==null?void 0:r.is_system)===!0}default:return!1}}catch{return!1}}function fe(t){return{resource_server:"resource server",role:"role",connection:"connection"}[t]}function J(){return async(t,e)=>{if(!["PATCH","PUT","DELETE"].includes(t.req.method))return e();const n=de(t.req.path);if(!n)return e();const r=t.var.tenant_id||t.req.header("x-tenant-id")||t.req.header("tenant-id");if(!r)return e();if(await ue(t.env.data,r,n))throw new S(403,{message:`This ${fe(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return e()}}const me=["client_secret","app_secret","twilio_token"];function U(t){if(!t)return t;const e={...t};for(const n of me)delete e[n];return e}function X(t,e){const{controlPlaneTenantId:n,controlPlaneClientId:r,excludeSensitiveFields:a=!1}=e;return{...t,multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:r},connections:{...t.connections,get:async(c,d)=>{var l;const s=await t.connections.get(c,d);if(!s||!n||c===n)return s;const o=(l=(await t.connections.list(n)).connections)==null?void 0:l.find(m=>m.strategy===s.strategy);if(!(o!=null&&o.options))return s;const i=y.connectionSchema.parse({...o,...s}),u=a?U(o.options):o.options;return i.options=y.connectionOptionsSchema.parse({...u||{},...s.options}),i},list:async(c,d)=>{const s=await t.connections.list(c,d);if(!n||c===n)return s;const f=await t.connections.list(n),o=s.connections.map(i=>{var p;const u=(p=f.connections)==null?void 0:p.find(g=>g.strategy===i.strategy);if(!(u!=null&&u.options))return i;const l=y.connectionSchema.parse({...u,...i}),m=a?U(u.options):u.options;return l.options=y.connectionOptionsSchema.parse({...m||{},...i.options}),l});return{...s,connections:o}}}}}function R(t,e){return X(t,e)}function Y(t){return async(e,n)=>{const r=e.var.user;return(r==null?void 0:r.tenant_id)===t&&r.org_name&&e.set("tenant_id",r.org_name),n()}}function Z(t){return async(e,n)=>{if(!t.accessControl)return n();const{controlPlaneTenantId:r}=t.accessControl,a=e.var.org_name,c=e.var.organization_id,d=a||c;let s=e.var.tenant_id;const f=e.var.user,i=(f!=null&&f.aud?Array.isArray(f.aud)?f.aud:[f.aud]:[]).includes(y.MANAGEMENT_API_AUDIENCE);if(!s&&d&&i&&(e.set("tenant_id",d),s=d),!s)throw new S(400,{message:"Tenant ID not found in request"});if(!K(c,s,r,a))throw new S(403,{message:`Access denied to tenant ${s}`});return n()}}function x(t){return async(e,n)=>{if(!t.subdomainRouting)return n();const{baseDomain:r,reservedSubdomains:a=[],resolveSubdomain:c}=t.subdomainRouting,d=e.req.header("host")||"";let s=null;if(d.endsWith(r)){const o=d.slice(0,-(r.length+1));o&&!o.includes(".")&&(s=o)}if(s&&a.includes(s)&&(s=null),!s)return t.accessControl&&e.set("tenant_id",t.accessControl.controlPlaneTenantId),n();let f=null;if(c)f=await c(s);else if(t.subdomainRouting.useOrganizations!==!1&&t.accessControl)try{const o=await e.env.data.organizations.get(t.accessControl.controlPlaneTenantId,s);o&&(f=o.id)}catch{}if(!f)throw new S(404,{message:`Tenant not found for subdomain: ${s}`});return e.set("tenant_id",f),n()}}function ee(t){return async(e,n)=>{if(!t.databaseIsolation)return n();const r=e.var.tenant_id;if(!r)throw new S(400,{message:"Tenant ID not found in request"});try{const a=await t.databaseIsolation.getAdapters(r);e.env.data=a}catch(a){throw console.error(`Failed to resolve database for tenant ${r}:`,a),new S(500,{message:"Failed to resolve tenant database"})}return n()}}function q(t){const e=x(t),n=Z(t),r=ee(t);return async(a,c)=>(await e(a,async()=>{}),await n(a,async()=>{}),await r(a,async()=>{}),c())}function pe(t){const{dataAdapter:e,controlPlane:n,controlPlane:{tenantId:r="control_plane",clientId:a}={},sync:c={resourceServers:!0,roles:!0},defaultPermissions:d=["tenant:admin"],requireOrganizationMatch:s=!1,managementApiExtensions:f=[],entityHooks:o,getChildTenantIds:i,getAdapters:u,...l}=t;let m=e,p=e;n&&(m=R(e,{controlPlaneTenantId:r,controlPlaneClientId:a}),p=R(e,{controlPlaneTenantId:r,controlPlaneClientId:a,excludeSensitiveFields:!0}));const g=c!==!1,v=g?{resourceServers:c.resourceServers??!0,roles:c.roles??!0}:{resourceServers:!1,roles:!1},A={controlPlaneTenantId:r,getChildTenantIds:i??(async()=>(await y.fetchAll(M=>m.tenants.list(M),"tenants",{cursorField:"id",pageSize:100})).filter(M=>M.id!==r).map(M=>M.id)),getAdapters:u??(async()=>m),getControlPlaneAdapters:async()=>m,sync:v},{entityHooks:P,tenantHooks:_}=Q(A),T={resourceServers:[P.resourceServers,...(o==null?void 0:o.resourceServers)??[]],roles:[P.roles,...(o==null?void 0:o.roles)??[]],connections:(o==null?void 0:o.connections)??[],tenants:(o==null?void 0:o.tenants)??[],rolePermissions:(o==null?void 0:o.rolePermissions)??[]},b=$({accessControl:{controlPlaneTenantId:r,requireOrganizationMatch:s,defaultPermissions:d}},{tenants:_}),{app:C}=y.init({dataAdapter:m,managementDataAdapter:p,...l,entityHooks:T,managementApiExtensions:[...f,{path:"/tenants",router:b}]});return C.use("/api/v2/*",Y(r)),g&&C.use("/api/v2/*",J()),{app:C,controlPlaneTenantId:r}}function ge(t){const e=F(t);return{name:"multi-tenancy",middleware:q(t),hooks:e,routes:[{path:"/management",handler:$(t,e)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),t.accessControl&&console.log(`  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`),t.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`),t.databaseIsolation&&console.log("  - Database isolation enabled")}}}function F(t){const e=t.accessControl?B(t.accessControl):{},n=t.databaseIsolation?V(t.databaseIsolation):{},r=W(t);return{...e,...n,tenants:r}}function te(t){const e=new se.Hono,n=F(t);return e.route("/tenants",$(t,n)),e}function we(t){return{hooks:F(t),middleware:q(t),app:te(t),config:t,wrapAdapters:(e,n)=>{var r;return R(e,{controlPlaneTenantId:(r=t.accessControl)==null?void 0:r.controlPlaneTenantId,controlPlaneClientId:n==null?void 0:n.controlPlaneClientId})}}}exports.createAccessControlHooks=B;exports.createAccessControlMiddleware=Z;exports.createControlPlaneTenantMiddleware=Y;exports.createDatabaseHooks=V;exports.createDatabaseMiddleware=ee;exports.createMultiTenancy=te;exports.createMultiTenancyHooks=F;exports.createMultiTenancyMiddleware=q;exports.createMultiTenancyPlugin=ge;exports.createProtectSyncedMiddleware=J;exports.createProvisioningHooks=W;exports.createRuntimeFallbackAdapter=X;exports.createSubdomainMiddleware=x;exports.createSyncHooks=Q;exports.createTenantsOpenAPIRouter=$;exports.initMultiTenant=pe;exports.setupMultiTenancy=we;exports.validateTenantAccess=K;exports.withRuntimeFallback=R;
+"use strict";var re=Object.defineProperty;var ae=(t,e,n)=>e in t?re(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n;var D=(t,e,n)=>ae(t,typeof e!="symbol"?e+"":e,n);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const se=require("hono"),T=require("authhero"),S=require("@hono/zod-openapi");function B(t){const{controlPlaneTenantId:e,requireOrganizationMatch:n=!0}=t;return{async onTenantAccessValidation(r,a){if(a===e)return!0;if(n){const o=r.var.org_name,c=r.var.organization_id,s=o||c;return s?s.toLowerCase()===a.toLowerCase():!1}return!0}}}function K(t,e,n,r){if(e===n)return!0;const a=r||t;return a?a.toLowerCase()===e.toLowerCase():!1}function W(t){return{async resolveDataAdapters(e){try{return await t.getAdapters(e)}catch(n){console.error(`Failed to resolve data adapters for tenant ${e}:`,n);return}}}}function oe(t){return`urn:authhero:tenant:${t.toLowerCase()}`}function V(t){return{async beforeCreate(e,n){return!n.audience&&n.id?{...n,audience:oe(n.id)}:n},async afterCreate(e,n){const{accessControl:r,databaseIsolation:a}=t;r&&e.ctx&&await ie(e,n,r),a!=null&&a.onProvision&&await a.onProvision(n.id)},async beforeDelete(e,n){const{accessControl:r,databaseIsolation:a}=t;if(r)try{const c=(await e.adapters.organizations.list(r.controlPlaneTenantId)).organizations.find(s=>s.name===n);c&&await e.adapters.organizations.remove(r.controlPlaneTenantId,c.id)}catch(o){console.warn(`Failed to remove organization for tenant ${n}:`,o)}if(a!=null&&a.onDeprovision)try{await a.onDeprovision(n)}catch(o){console.warn(`Failed to deprovision database for tenant ${n}:`,o)}}}}async function ie(t,e,n){const{controlPlaneTenantId:r,defaultPermissions:a,defaultRoles:o,issuer:c,adminRoleName:s="Tenant Admin",adminRoleDescription:d="Full access to all tenant management operations",addCreatorToOrganization:i=!0}=n,l=await t.adapters.organizations.create(r,{name:e.id,display_name:e.friendly_name||e.id});let g;if(c&&(g=await le(t,r,s,d)),i&&t.ctx){const u=t.ctx.var.user;if(u!=null&&u.sub&&!await ce(t,r,u.sub))try{await t.adapters.userOrganizations.create(r,{user_id:u.sub,organization_id:l.id}),g&&await t.adapters.userRoles.create(r,u.sub,g,l.id)}catch(m){console.warn(`Failed to add creator ${u.sub} to organization ${l.id}:`,m)}}o&&o.length>0&&console.log(`Would assign roles ${o.join(", ")} to organization ${l.id}`),a&&a.length>0&&console.log(`Would grant permissions ${a.join(", ")} to organization ${l.id}`)}async function ce(t,e,n){const r=await t.adapters.userRoles.list(e,n,void 0,"");for(const a of r)if((await t.adapters.rolePermissions.list(e,a.id,{per_page:1e3})).some(s=>s.permission_name==="admin:organizations"))return!0;return!1}async function le(t,e,n,r){const o=(await t.adapters.roles.list(e,{})).roles.find(i=>i.name===n);if(o)return o.id;const c=await t.adapters.roles.create(e,{name:n,description:r}),s=T.MANAGEMENT_API_AUDIENCE,d=T.MANAGEMENT_API_SCOPES.map(i=>({role_id:c.id,resource_server_identifier:s,permission_name:i.value}));return await t.adapters.rolePermissions.assign(e,c.id,d),c.id}function N(t,e,n=()=>!0){const{controlPlaneTenantId:r,getChildTenantIds:a,getAdapters:o}=t,c=new Map;async function s(l,g,u){return(await e(l).list(g,{q:`name:${u}`,per_page:1}))[0]??null}async function d(l){const g=await a(),u=e(await o(r));await Promise.all(g.map(async f=>{try{const m=await o(f),p=e(m),w={...u.transform(l),is_system:!0},y=await s(m,f,l.name),P=y?p.getId(y):void 0;if(y&&P){const A=p.preserveOnUpdate?p.preserveOnUpdate(y,w):w;await p.update(f,P,A)}else await p.create(f,w)}catch(m){console.error(`Failed to sync ${u.listKey} "${l.name}" to tenant "${f}":`,m)}}))}async function i(l){const g=await a();await Promise.all(g.map(async u=>{try{const f=await o(u),m=e(f),p=await s(f,u,l),h=p?m.getId(p):void 0;p&&h&&await m.remove(u,h)}catch(f){console.error(`Failed to delete entity "${l}" from tenant "${u}":`,f)}}))}return{afterCreate:async(l,g)=>{l.tenantId===r&&n(g)&&await d(g)},afterUpdate:async(l,g,u)=>{l.tenantId===r&&n(u)&&await d(u)},beforeDelete:async(l,g)=>{if(l.tenantId!==r)return;const f=await e(l.adapters).get(l.tenantId,g);f&&n(f)&&c.set(g,f)},afterDelete:async(l,g)=>{if(l.tenantId!==r)return;const u=c.get(g);u&&(c.delete(g),await i(u.name))}}}function H(t,e,n=()=>!0){const{controlPlaneTenantId:r,getControlPlaneAdapters:a,getAdapters:o}=t;return{async afterCreate(c,s){if(s.id!==r)try{const d=await a(),i=await o(s.id),l=e(d),g=e(i),u=await T.fetchAll(f=>l.listPaginated(r,f),l.listKey,{cursorField:"id",pageSize:100});await Promise.all(u.filter(f=>n(f)).map(async f=>{try{const m=l.transform(f);await g.create(s.id,{...m,is_system:!0})}catch(m){console.error(`Failed to sync entity to new tenant "${s.id}":`,m)}}))}catch(d){console.error(`Failed to sync entities to new tenant "${s.id}":`,d)}}}}const G=t=>({list:async(e,n)=>(await t.resourceServers.list(e,n)).resource_servers,listPaginated:(e,n)=>t.resourceServers.list(e,n),get:(e,n)=>t.resourceServers.get(e,n),create:(e,n)=>t.resourceServers.create(e,n),update:(e,n,r)=>t.resourceServers.update(e,n,r),remove:(e,n)=>t.resourceServers.remove(e,n),listKey:"resource_servers",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,identifier:e.identifier,scopes:e.scopes,signing_alg:e.signing_alg,token_lifetime:e.token_lifetime,token_lifetime_for_web:e.token_lifetime_for_web})}),L=t=>({list:async(e,n)=>(await t.roles.list(e,n)).roles,listPaginated:(e,n)=>t.roles.list(e,n),get:(e,n)=>t.roles.get(e,n),create:(e,n)=>t.roles.create(e,n),update:(e,n,r)=>t.roles.update(e,n,r),remove:(e,n)=>t.roles.remove(e,n),listKey:"roles",getId:e=>e.id,transform:e=>({id:e.id,name:e.name,description:e.description})});function U(t){var e;return((e=t.metadata)==null?void 0:e.sync)!==!1}function Q(t){const{sync:e={},filters:n={}}=t,r=e.resourceServers??!0,a=e.roles??!0,o=m=>U(m)?n.resourceServers?n.resourceServers(m):!0:!1,c=m=>U(m)?n.roles?n.roles(m):!0:!1,s=r?N(t,G,o):void 0,d=a?N(t,L,c):void 0,i=r?H(t,G,o):void 0,l=a?H(t,L,c):void 0,g=a?{async afterCreate(m,p){var h;if(p.id!==t.controlPlaneTenantId){await((h=l==null?void 0:l.afterCreate)==null?void 0:h.call(l,m,p));try{const w=await t.getControlPlaneAdapters(),y=await t.getAdapters(p.id),P=await T.fetchAll(C=>w.roles.list(t.controlPlaneTenantId,C),"roles",{cursorField:"id",pageSize:100}),A=new Map;for(const C of P.filter(v=>{var _;return((_=n.roles)==null?void 0:_.call(n,v))??!0})){const v=await u(y,p.id,C.name);v&&A.set(C.name,v.id)}for(const C of P.filter(v=>{var _;return((_=n.roles)==null?void 0:_.call(n,v))??!0})){const v=A.get(C.name);if(v)try{const _=await w.rolePermissions.list(t.controlPlaneTenantId,C.id,{});_.length>0&&await y.rolePermissions.assign(p.id,v,_.map(b=>({role_id:v,resource_server_identifier:b.resource_server_identifier,permission_name:b.permission_name})))}catch(_){console.error(`Failed to sync permissions for role "${C.name}" to tenant "${p.id}":`,_)}}}catch(w){console.error(`Failed to sync role permissions to tenant "${p.id}":`,w)}}}}:void 0;async function u(m,p,h){return(await m.roles.list(p,{q:`name:${h}`,per_page:1})).roles[0]??null}return{entityHooks:{resourceServers:s,roles:d},tenantHooks:{async afterCreate(m,p){const h=[i==null?void 0:i.afterCreate,(g==null?void 0:g.afterCreate)??(l==null?void 0:l.afterCreate)],w=[];for(const y of h)if(y)try{await y(m,p)}catch(P){w.push(P instanceof Error?P:new Error(String(P)))}if(w.length===1)throw w[0];if(w.length>1)throw new AggregateError(w,w.map(y=>y.message).join("; "))}}}}var I=class extends Error{constructor(e=500,n){super(n==null?void 0:n.message,{cause:n==null?void 0:n.cause});D(this,"res");D(this,"status");this.res=n==null?void 0:n.res,this.status=e}getResponse(){return this.res?new Response(this.res.body,{status:this.status,headers:this.res.headers}):new Response(this.message,{status:this.status})}};function $(t,e){const n=new S.OpenAPIHono;return n.openapi(S.createRoute({tags:["tenants"],method:"get",path:"/",request:{query:T.auth0QuerySchema},security:[{Bearer:[]}],responses:{200:{content:{"application/json":{schema:S.z.object({tenants:S.z.array(T.tenantSchema),start:S.z.number().optional(),limit:S.z.number().optional(),length:S.z.number().optional()})}},description:"List of tenants"}}}),async r=>{var m,p,h,w,y,P;const a=r.req.valid("query"),{page:o,per_page:c,include_totals:s,q:d}=a,i=r.var.user,l=(i==null?void 0:i.permissions)||[];if(l.includes("auth:read")||l.includes("admin:organizations")){const A=await r.env.data.tenants.list({page:o,per_page:c,include_totals:s,q:d});return s?r.json({tenants:A.tenants,start:((m=A.totals)==null?void 0:m.start)??0,limit:((p=A.totals)==null?void 0:p.limit)??c,length:A.tenants.length}):r.json({tenants:A.tenants})}const u=((h=t.accessControl)==null?void 0:h.controlPlaneTenantId)??((w=r.env.data.multiTenancyConfig)==null?void 0:w.controlPlaneTenantId);if(u&&(i!=null&&i.sub)){const C=(await T.fetchAll(R=>r.env.data.userOrganizations.listUserOrganizations(u,i.sub,R),"organizations")).map(R=>R.name);if(C.length===0)return s?r.json({tenants:[],start:0,limit:c??50,length:0}):r.json({tenants:[]});const v=C.length,_=o??0,b=c??50,z=_*b,M=C.slice(z,z+b);if(M.length===0)return s?r.json({tenants:[],start:z,limit:b,length:v}):r.json({tenants:[]});const k=M.map(R=>`id:${R}`).join(" OR "),ne=d?`(${k}) AND (${d})`:k,j=await r.env.data.tenants.list({q:ne,per_page:b,include_totals:!1});return s?r.json({tenants:j.tenants,start:z,limit:b,length:v}):r.json({tenants:j.tenants})}const f=await r.env.data.tenants.list({page:o,per_page:c,include_totals:s,q:d});return s?r.json({tenants:f.tenants,start:((y=f.totals)==null?void 0:y.start)??0,limit:((P=f.totals)==null?void 0:P.limit)??c,length:f.tenants.length}):r.json({tenants:f.tenants})}),n.openapi(S.createRoute({tags:["tenants"],method:"post",path:"/",request:{body:{content:{"application/json":{schema:T.tenantInsertSchema}}}},security:[{Bearer:[]}],responses:{201:{content:{"application/json":{schema:T.tenantSchema}},description:"Tenant created"},400:{description:"Validation error"},409:{description:"Tenant with this ID already exists"}}}),async r=>{var d,i;const a=r.var.user;if(!(a!=null&&a.sub))throw new I(401,{message:"Authentication required to create tenants"});let o=r.req.valid("json");const c={adapters:r.env.data,ctx:r};(d=e.tenants)!=null&&d.beforeCreate&&(o=await e.tenants.beforeCreate(c,o));const s=await r.env.data.tenants.create(o);return(i=e.tenants)!=null&&i.afterCreate&&await e.tenants.afterCreate(c,s),r.json(s,201)}),n.openapi(S.createRoute({tags:["tenants"],method:"delete",path:"/{id}",request:{params:S.z.object({id:S.z.string()})},security:[{Bearer:["delete:tenants"]}],responses:{204:{description:"Tenant deleted"},403:{description:"Access denied or cannot delete the control plane"},404:{description:"Tenant not found"}}}),async r=>{var d,i,l,g;const{id:a}=r.req.valid("param"),o=((d=t.accessControl)==null?void 0:d.controlPlaneTenantId)??((i=r.env.data.multiTenancyConfig)==null?void 0:i.controlPlaneTenantId);if(o){const u=r.var.user;if(!(u!=null&&u.sub))throw new I(401,{message:"Authentication required"});if(a===o)throw new I(403,{message:"Cannot delete the control plane"});if(!(await T.fetchAll(p=>r.env.data.userOrganizations.listUserOrganizations(o,u.sub,p),"organizations")).some(p=>p.name===a))throw new I(403,{message:"Access denied to this tenant"})}if(!await r.env.data.tenants.get(a))throw new I(404,{message:"Tenant not found"});const s={adapters:r.env.data,ctx:r};return(l=e.tenants)!=null&&l.beforeDelete&&await e.tenants.beforeDelete(s,a),await r.env.data.tenants.remove(a),(g=e.tenants)!=null&&g.afterDelete&&await e.tenants.afterDelete(s,a),r.body(null,204)}),n}function de(t){const e=[{pattern:/\/api\/v2\/resource-servers\/([^/]+)$/,type:"resource_server"},{pattern:/\/api\/v2\/roles\/([^/]+)$/,type:"role"},{pattern:/\/api\/v2\/connections\/([^/]+)$/,type:"connection"}];for(const{pattern:n,type:r}of e){const a=t.match(n);if(a&&a[1])return{type:r,id:a[1]}}return null}async function ue(t,e,n){try{switch(n.type){case"resource_server":{const r=await t.resourceServers.get(e,n.id);return(r==null?void 0:r.is_system)===!0}case"role":{const r=await t.roles.get(e,n.id);return(r==null?void 0:r.is_system)===!0}case"connection":{const r=await t.connections.get(e,n.id);return(r==null?void 0:r.is_system)===!0}default:return!1}}catch{return!1}}function fe(t){return{resource_server:"resource server",role:"role",connection:"connection"}[t]}function J(){return async(t,e)=>{if(!["PATCH","PUT","DELETE"].includes(t.req.method))return e();const n=de(t.req.path);if(!n)return e();const r=t.var.tenant_id||t.req.header("x-tenant-id")||t.req.header("tenant-id");if(!r)return e();if(await ue(t.env.data,r,n))throw new I(403,{message:`This ${fe(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`});return e()}}const me=["client_secret","app_secret","twilio_token"];function ge(t){if(!t)return t;const e={...t};for(const n of me)delete e[n];return e}function q(t,e,n){const r=e.find(c=>c.strategy===t.strategy);if(!(r!=null&&r.options))return t;const a=T.connectionSchema.passthrough().parse({...r,...t}),o=n?ge(r.options):r.options;return a.options=T.connectionOptionsSchema.passthrough().parse({...o||{},...t.options}),a}function X(t,e){const{controlPlaneTenantId:n,controlPlaneClientId:r,excludeSensitiveFields:a=!1}=e;return{...t,multiTenancyConfig:{controlPlaneTenantId:n,controlPlaneClientId:r},connections:{...t.connections,get:async(o,c)=>{const s=await t.connections.get(o,c);if(!s||!n||o===n)return s;const d=await t.connections.list(n);return q(s,d.connections||[],a)},list:async(o,c)=>{const s=await t.connections.list(o,c);if(!n||o===n)return s;const d=await t.connections.list(n),i=s.connections.map(l=>q(l,d.connections||[],a));return{...s,connections:i}}},clientConnections:{...t.clientConnections,listByClient:async(o,c)=>{let s=await t.clientConnections.listByClient(o,c);if(s.length===0&&(s=(await t.connections.list(o)).connections||[]),!n||o===n)return s;const d=await t.connections.list(n);return s.map(i=>q(i,d.connections||[],a))}},emailProviders:{...t.emailProviders,get:async o=>{const c=await t.emailProviders.get(o);return c||(!n||o===n?null:t.emailProviders.get(n))}}}}function F(t,e){return X(t,e)}function Y(t){return async(e,n)=>{const r=e.var.user;return(r==null?void 0:r.tenant_id)===t&&r.org_name&&e.set("tenant_id",r.org_name),n()}}function Z(t){return async(e,n)=>{if(!t.accessControl)return n();const{controlPlaneTenantId:r}=t.accessControl,a=e.var.org_name,o=e.var.organization_id,c=a||o;let s=e.var.tenant_id;const d=e.var.user,l=(d!=null&&d.aud?Array.isArray(d.aud)?d.aud:[d.aud]:[]).includes(T.MANAGEMENT_API_AUDIENCE);if(!s&&c&&l&&(e.set("tenant_id",c),s=c),!s)throw new I(400,{message:"Tenant ID not found in request"});if(!K(o,s,r,a))throw new I(403,{message:`Access denied to tenant ${s}`});return n()}}function x(t){return async(e,n)=>{if(!t.subdomainRouting)return n();const{baseDomain:r,reservedSubdomains:a=[],resolveSubdomain:o}=t.subdomainRouting,c=e.req.header("host")||"";let s=null;if(c.endsWith(r)){const i=c.slice(0,-(r.length+1));i&&!i.includes(".")&&(s=i)}if(s&&a.includes(s)&&(s=null),!s)return t.accessControl&&e.set("tenant_id",t.accessControl.controlPlaneTenantId),n();let d=null;if(o)d=await o(s);else if(t.subdomainRouting.useOrganizations!==!1&&t.accessControl)try{const i=await e.env.data.organizations.get(t.accessControl.controlPlaneTenantId,s);i&&(d=i.id)}catch{}if(!d)throw new I(404,{message:`Tenant not found for subdomain: ${s}`});return e.set("tenant_id",d),n()}}function ee(t){return async(e,n)=>{if(!t.databaseIsolation)return n();const r=e.var.tenant_id;if(!r)throw new I(400,{message:"Tenant ID not found in request"});try{const a=await t.databaseIsolation.getAdapters(r);e.env.data=a}catch(a){throw console.error(`Failed to resolve database for tenant ${r}:`,a),new I(500,{message:"Failed to resolve tenant database"})}return n()}}function E(t){const e=x(t),n=Z(t),r=ee(t);return async(a,o)=>(await e(a,async()=>{}),await n(a,async()=>{}),await r(a,async()=>{}),o())}function pe(t){const{dataAdapter:e,controlPlane:n,controlPlane:{tenantId:r="control_plane",clientId:a}={},sync:o={resourceServers:!0,roles:!0},defaultPermissions:c=["tenant:admin"],requireOrganizationMatch:s=!1,managementApiExtensions:d=[],entityHooks:i,getChildTenantIds:l,getAdapters:g,...u}=t;let f=e,m=e;n&&(f=F(e,{controlPlaneTenantId:r,controlPlaneClientId:a}),m=F(e,{controlPlaneTenantId:r,controlPlaneClientId:a,excludeSensitiveFields:!0}));const p=o!==!1,h=p?{resourceServers:o.resourceServers??!0,roles:o.roles??!0}:{resourceServers:!1,roles:!1},P={controlPlaneTenantId:r,getChildTenantIds:l??(async()=>(await T.fetchAll(M=>f.tenants.list(M),"tenants",{cursorField:"id",pageSize:100})).filter(M=>M.id!==r).map(M=>M.id)),getAdapters:g??(async()=>f),getControlPlaneAdapters:async()=>f,sync:h},{entityHooks:A,tenantHooks:C}=Q(P),v={resourceServers:[A.resourceServers,...(i==null?void 0:i.resourceServers)??[]],roles:[A.roles,...(i==null?void 0:i.roles)??[]],connections:(i==null?void 0:i.connections)??[],tenants:(i==null?void 0:i.tenants)??[],rolePermissions:(i==null?void 0:i.rolePermissions)??[]},_=$({accessControl:{controlPlaneTenantId:r,requireOrganizationMatch:s,defaultPermissions:c}},{tenants:C}),{app:b}=T.init({dataAdapter:f,managementDataAdapter:m,...u,entityHooks:v,managementApiExtensions:[...d,{path:"/tenants",router:_}]});return b.use("/api/v2/*",Y(r)),p&&b.use("/api/v2/*",J()),{app:b,controlPlaneTenantId:r}}function we(t){const e=O(t);return{name:"multi-tenancy",middleware:E(t),hooks:e,routes:[{path:"/management",handler:$(t,e)}],onRegister:async()=>{console.log("Multi-tenancy plugin registered"),t.accessControl&&console.log(`  - Access control enabled (control plane: ${t.accessControl.controlPlaneTenantId})`),t.subdomainRouting&&console.log(`  - Subdomain routing enabled (base domain: ${t.subdomainRouting.baseDomain})`),t.databaseIsolation&&console.log("  - Database isolation enabled")}}}function O(t){const e=t.accessControl?B(t.accessControl):{},n=t.databaseIsolation?W(t.databaseIsolation):{},r=V(t);return{...e,...n,tenants:r}}function te(t){const e=new se.Hono,n=O(t);return e.route("/tenants",$(t,n)),e}function ye(t){return{hooks:O(t),middleware:E(t),app:te(t),config:t,wrapAdapters:(e,n)=>{var r;return F(e,{controlPlaneTenantId:(r=t.accessControl)==null?void 0:r.controlPlaneTenantId,controlPlaneClientId:n==null?void 0:n.controlPlaneClientId})}}}exports.createAccessControlHooks=B;exports.createAccessControlMiddleware=Z;exports.createControlPlaneTenantMiddleware=Y;exports.createDatabaseHooks=W;exports.createDatabaseMiddleware=ee;exports.createMultiTenancy=te;exports.createMultiTenancyHooks=O;exports.createMultiTenancyMiddleware=E;exports.createMultiTenancyPlugin=we;exports.createProtectSyncedMiddleware=J;exports.createProvisioningHooks=V;exports.createRuntimeFallbackAdapter=X;exports.createSubdomainMiddleware=x;exports.createSyncHooks=Q;exports.createTenantsOpenAPIRouter=$;exports.initMultiTenant=pe;exports.setupMultiTenancy=ye;exports.validateTenantAccess=K;exports.withRuntimeFallback=F;

package/dist/multi-tenancy.mjs

@@ -1,8 +1,8 @@
-var X = Object.defineProperty;
-var Y = (t, e, n) => e in t ? X(t, e, { enumerable: !0, configurable: !0, writable: !0, value: n }) : t[e] = n;
-var O = (t, e, n) => Y(t, typeof e != "symbol" ? e + "" : e, n);
-import { Hono as Z } from "hono";
-import { MANAGEMENT_API_SCOPES as x, MANAGEMENT_API_AUDIENCE as W, fetchAll as F, auth0QuerySchema as ee, tenantSchema as N, tenantInsertSchema as te, connectionSchema as k, connectionOptionsSchema as H, init as ne } from "authhero";
+var Q = Object.defineProperty;
+var J = (t, e, n) => e in t ? Q(t, e, { enumerable: !0, configurable: !0, writable: !0, value: n }) : t[e] = n;
+var O = (t, e, n) => J(t, typeof e != "symbol" ? e + "" : e, n);
+import { Hono as X } from "hono";
+import { MANAGEMENT_API_SCOPES as Y, MANAGEMENT_API_AUDIENCE as K, fetchAll as F, auth0QuerySchema as Z, tenantSchema as k, tenantInsertSchema as x, connectionSchema as ee, connectionOptionsSchema as te, init as ne } from "authhero";
 import { OpenAPIHono as re, createRoute as R, z as S } from "@hono/zod-openapi";
 function ae(t) {
   const { controlPlaneTenantId: e, requireOrganizationMatch: n = !0 } = t;
@@ -11,7 +11,7 @@ function ae(t) {
       if (a === e)
         return !0;
       if (n) {
-        const c = r.var.org_name, d = r.var.organization_id, s = c || d;
+        const o = r.var.org_name, c = r.var.organization_id, s = o || c;
         return s ? s.toLowerCase() === a.toLowerCase() : !1;
       }
       return !0;
@@ -58,26 +58,26 @@ function ce(t) {
       const { accessControl: r, databaseIsolation: a } = t;
       if (r)
         try {
-          const d = (await e.adapters.organizations.list(
+          const c = (await e.adapters.organizations.list(
             r.controlPlaneTenantId
           )).organizations.find((s) => s.name === n);
-          d && await e.adapters.organizations.remove(
+          c && await e.adapters.organizations.remove(
             r.controlPlaneTenantId,
-            d.id
+            c.id
           );
-        } catch (c) {
+        } catch (o) {
           console.warn(
             `Failed to remove organization for tenant ${n}:`,
-            c
+            o
           );
         }
       if (a != null && a.onDeprovision)
         try {
           await a.onDeprovision(n);
-        } catch (c) {
+        } catch (o) {
           console.warn(
             `Failed to deprovision database for tenant ${n}:`,
-            c
+            o
           );
         }
     }
@@ -87,53 +87,53 @@ async function le(t, e, n) {
   const {
     controlPlaneTenantId: r,
     defaultPermissions: a,
-    defaultRoles: c,
-    issuer: d,
+    defaultRoles: o,
+    issuer: c,
     adminRoleName: s = "Tenant Admin",
-    adminRoleDescription: f = "Full access to all tenant management operations",
-    addCreatorToOrganization: o = !0
-  } = n, i = await t.adapters.organizations.create(
+    adminRoleDescription: d = "Full access to all tenant management operations",
+    addCreatorToOrganization: i = !0
+  } = n, l = await t.adapters.organizations.create(
     r,
     {
       name: e.id,
       display_name: e.friendly_name || e.id
     }
   );
-  let u;
-  if (d && (u = await ue(
+  let g;
+  if (c && (g = await ue(
     t,
     r,
     s,
-    f
-  )), o && t.ctx) {
-    const l = t.ctx.var.user;
-    if (l != null && l.sub && !await de(
+    d
+  )), i && t.ctx) {
+    const u = t.ctx.var.user;
+    if (u != null && u.sub && !await de(
       t,
       r,
-      l.sub
+      u.sub
     ))
       try {
         await t.adapters.userOrganizations.create(r, {
-          user_id: l.sub,
-          organization_id: i.id
-        }), u && await t.adapters.userRoles.create(
+          user_id: u.sub,
+          organization_id: l.id
+        }), g && await t.adapters.userRoles.create(
           r,
-          l.sub,
-          u,
-          i.id
+          u.sub,
+          g,
+          l.id
           // organizationId
         );
-      } catch (p) {
+      } catch (m) {
         console.warn(
-          `Failed to add creator ${l.sub} to organization ${i.id}:`,
-          p
+          `Failed to add creator ${u.sub} to organization ${l.id}:`,
+          m
         );
       }
   }
-  c && c.length > 0 && console.log(
-    `Would assign roles ${c.join(", ")} to organization ${i.id}`
+  o && o.length > 0 && console.log(
+    `Would assign roles ${o.join(", ")} to organization ${l.id}`
   ), a && a.length > 0 && console.log(
-    `Would grant permissions ${a.join(", ")} to organization ${i.id}`
+    `Would grant permissions ${a.join(", ")} to organization ${l.id}`
   );
 }
 async function de(t, e, n) {
@@ -156,126 +156,126 @@ async function de(t, e, n) {
   return !1;
 }
 async function ue(t, e, n, r) {
-  const c = (await t.adapters.roles.list(e, {})).roles.find((o) => o.name === n);
-  if (c)
-    return c.id;
-  const d = await t.adapters.roles.create(e, {
+  const o = (await t.adapters.roles.list(e, {})).roles.find((i) => i.name === n);
+  if (o)
+    return o.id;
+  const c = await t.adapters.roles.create(e, {
     name: n,
     description: r
-  }), s = W, f = x.map((o) => ({
-    role_id: d.id,
+  }), s = K, d = Y.map((i) => ({
+    role_id: c.id,
     resource_server_identifier: s,
-    permission_name: o.value
+    permission_name: i.value
   }));
   return await t.adapters.rolePermissions.assign(
     e,
-    d.id,
-    f
-  ), d.id;
+    c.id,
+    d
+  ), c.id;
 }
-function G(t, e, n = () => !0) {
-  const { controlPlaneTenantId: r, getChildTenantIds: a, getAdapters: c } = t, d = /* @__PURE__ */ new Map();
-  async function s(i, u, l) {
-    return (await e(i).list(u, {
-      q: `name:${l}`,
+function H(t, e, n = () => !0) {
+  const { controlPlaneTenantId: r, getChildTenantIds: a, getAdapters: o } = t, c = /* @__PURE__ */ new Map();
+  async function s(l, g, u) {
+    return (await e(l).list(g, {
+      q: `name:${u}`,
       per_page: 1
     }))[0] ?? null;
   }
-  async function f(i) {
-    const u = await a(), l = e(await c(r));
+  async function d(l) {
+    const g = await a(), u = e(await o(r));
     await Promise.all(
-      u.map(async (m) => {
+      g.map(async (f) => {
         try {
-          const p = await c(m), g = e(p), w = {
-            ...l.transform(i),
+          const m = await o(f), p = e(m), w = {
+            ...u.transform(l),
             is_system: !0
-          }, y = await s(p, m, i.name), T = y ? g.getId(y) : void 0;
+          }, y = await s(m, f, l.name), T = y ? p.getId(y) : void 0;
           if (y && T) {
-            const A = g.preserveOnUpdate ? g.preserveOnUpdate(y, w) : w;
-            await g.update(m, T, A);
+            const C = p.preserveOnUpdate ? p.preserveOnUpdate(y, w) : w;
+            await p.update(f, T, C);
           } else
-            await g.create(m, w);
-        } catch (p) {
+            await p.create(f, w);
+        } catch (m) {
           console.error(
-            `Failed to sync ${l.listKey} "${i.name}" to tenant "${m}":`,
-            p
+            `Failed to sync ${u.listKey} "${l.name}" to tenant "${f}":`,
+            m
           );
         }
       })
     );
   }
-  async function o(i) {
-    const u = await a();
+  async function i(l) {
+    const g = await a();
     await Promise.all(
-      u.map(async (l) => {
+      g.map(async (u) => {
         try {
-          const m = await c(l), p = e(m), g = await s(m, l, i), h = g ? p.getId(g) : void 0;
-          g && h && await p.remove(l, h);
-        } catch (m) {
+          const f = await o(u), m = e(f), p = await s(f, u, l), h = p ? m.getId(p) : void 0;
+          p && h && await m.remove(u, h);
+        } catch (f) {
           console.error(
-            `Failed to delete entity "${i}" from tenant "${l}":`,
-            m
+            `Failed to delete entity "${l}" from tenant "${u}":`,
+            f
           );
         }
       })
     );
   }
   return {
-    afterCreate: async (i, u) => {
-      i.tenantId === r && n(u) && await f(u);
+    afterCreate: async (l, g) => {
+      l.tenantId === r && n(g) && await d(g);
     },
-    afterUpdate: async (i, u, l) => {
-      i.tenantId === r && n(l) && await f(l);
+    afterUpdate: async (l, g, u) => {
+      l.tenantId === r && n(u) && await d(u);
     },
-    beforeDelete: async (i, u) => {
-      if (i.tenantId !== r) return;
-      const m = await e(i.adapters).get(i.tenantId, u);
-      m && n(m) && d.set(u, m);
+    beforeDelete: async (l, g) => {
+      if (l.tenantId !== r) return;
+      const f = await e(l.adapters).get(l.tenantId, g);
+      f && n(f) && c.set(g, f);
     },
-    afterDelete: async (i, u) => {
-      if (i.tenantId !== r) return;
-      const l = d.get(u);
-      l && (d.delete(u), await o(l.name));
+    afterDelete: async (l, g) => {
+      if (l.tenantId !== r) return;
+      const u = c.get(g);
+      u && (c.delete(g), await i(u.name));
     }
   };
 }
-function L(t, e, n = () => !0) {
-  const { controlPlaneTenantId: r, getControlPlaneAdapters: a, getAdapters: c } = t;
+function G(t, e, n = () => !0) {
+  const { controlPlaneTenantId: r, getControlPlaneAdapters: a, getAdapters: o } = t;
   return {
-    async afterCreate(d, s) {
+    async afterCreate(c, s) {
       if (s.id !== r)
         try {
-          const f = await a(), o = await c(s.id), i = e(f), u = e(o), l = await F(
-            (m) => i.listPaginated(r, m),
-            i.listKey,
+          const d = await a(), i = await o(s.id), l = e(d), g = e(i), u = await F(
+            (f) => l.listPaginated(r, f),
+            l.listKey,
             { cursorField: "id", pageSize: 100 }
           );
           await Promise.all(
-            l.filter((m) => n(m)).map(async (m) => {
+            u.filter((f) => n(f)).map(async (f) => {
               try {
-                const p = i.transform(m);
-                await u.create(s.id, {
-                  ...p,
+                const m = l.transform(f);
+                await g.create(s.id, {
+                  ...m,
                   is_system: !0
                 });
-              } catch (p) {
+              } catch (m) {
                 console.error(
                   `Failed to sync entity to new tenant "${s.id}":`,
-                  p
+                  m
                 );
               }
             })
           );
-        } catch (f) {
+        } catch (d) {
           console.error(
             `Failed to sync entities to new tenant "${s.id}":`,
-            f
+            d
           );
         }
     }
   };
 }
-const U = (t) => ({
+const L = (t) => ({
   list: async (e, n) => (await t.resourceServers.list(e, n)).resource_servers,
   listPaginated: (e, n) => t.resourceServers.list(e, n),
   get: (e, n) => t.resourceServers.get(e, n),
@@ -308,95 +308,95 @@ const U = (t) => ({
     description: e.description
   })
 });
-function K(t) {
+function U(t) {
   var e;
   return ((e = t.metadata) == null ? void 0 : e.sync) !== !1;
 }
 function fe(t) {
-  const { sync: e = {}, filters: n = {} } = t, r = e.resourceServers ?? !0, a = e.roles ?? !0, c = (p) => K(p) ? n.resourceServers ? n.resourceServers(p) : !0 : !1, d = (p) => K(p) ? n.roles ? n.roles(p) : !0 : !1, s = r ? G(
+  const { sync: e = {}, filters: n = {} } = t, r = e.resourceServers ?? !0, a = e.roles ?? !0, o = (m) => U(m) ? n.resourceServers ? n.resourceServers(m) : !0 : !1, c = (m) => U(m) ? n.roles ? n.roles(m) : !0 : !1, s = r ? H(
     t,
-    U,
-    c
-  ) : void 0, f = a ? G(
+    L,
+    o
+  ) : void 0, d = a ? H(
     t,
     B,
-    d
-  ) : void 0, o = r ? L(
-    t,
-    U,
     c
-  ) : void 0, i = a ? L(
+  ) : void 0, i = r ? G(
+    t,
+    L,
+    o
+  ) : void 0, l = a ? G(
     t,
     B,
-    d
-  ) : void 0, u = a ? {
-    async afterCreate(p, g) {
+    c
+  ) : void 0, g = a ? {
+    async afterCreate(m, p) {
       var h;
-      if (g.id !== t.controlPlaneTenantId) {
-        await ((h = i == null ? void 0 : i.afterCreate) == null ? void 0 : h.call(i, p, g));
+      if (p.id !== t.controlPlaneTenantId) {
+        await ((h = l == null ? void 0 : l.afterCreate) == null ? void 0 : h.call(l, m, p));
         try {
-          const w = await t.getControlPlaneAdapters(), y = await t.getAdapters(g.id), T = await F(
-            (_) => w.roles.list(
+          const w = await t.getControlPlaneAdapters(), y = await t.getAdapters(p.id), T = await F(
+            (P) => w.roles.list(
               t.controlPlaneTenantId,
-              _
+              P
             ),
             "roles",
             { cursorField: "id", pageSize: 100 }
-          ), A = /* @__PURE__ */ new Map();
-          for (const _ of T.filter(
+          ), C = /* @__PURE__ */ new Map();
+          for (const P of T.filter(
             (v) => {
-              var P;
-              return ((P = n.roles) == null ? void 0 : P.call(n, v)) ?? !0;
+              var _;
+              return ((_ = n.roles) == null ? void 0 : _.call(n, v)) ?? !0;
             }
           )) {
-            const v = await l(
+            const v = await u(
               y,
-              g.id,
-              _.name
+              p.id,
+              P.name
             );
-            v && A.set(_.name, v.id);
+            v && C.set(P.name, v.id);
           }
-          for (const _ of T.filter(
+          for (const P of T.filter(
             (v) => {
-              var P;
-              return ((P = n.roles) == null ? void 0 : P.call(n, v)) ?? !0;
+              var _;
+              return ((_ = n.roles) == null ? void 0 : _.call(n, v)) ?? !0;
             }
           )) {
-            const v = A.get(_.name);
+            const v = C.get(P.name);
             if (v)
               try {
-                const P = await w.rolePermissions.list(
+                const _ = await w.rolePermissions.list(
                   t.controlPlaneTenantId,
-                  _.id,
+                  P.id,
                   {}
                 );
-                P.length > 0 && await y.rolePermissions.assign(
-                  g.id,
+                _.length > 0 && await y.rolePermissions.assign(
+                  p.id,
                   v,
-                  P.map((C) => ({
+                  _.map((A) => ({
                     role_id: v,
-                    resource_server_identifier: C.resource_server_identifier,
-                    permission_name: C.permission_name
+                    resource_server_identifier: A.resource_server_identifier,
+                    permission_name: A.permission_name
                   }))
                 );
-              } catch (P) {
+              } catch (_) {
                 console.error(
-                  `Failed to sync permissions for role "${_.name}" to tenant "${g.id}":`,
-                  P
+                  `Failed to sync permissions for role "${P.name}" to tenant "${p.id}":`,
+                  _
                 );
               }
           }
         } catch (w) {
           console.error(
-            `Failed to sync role permissions to tenant "${g.id}":`,
+            `Failed to sync role permissions to tenant "${p.id}":`,
             w
           );
         }
       }
     }
   } : void 0;
-  async function l(p, g, h) {
-    return (await p.roles.list(g, {
+  async function u(m, p, h) {
+    return (await m.roles.list(p, {
       q: `name:${h}`,
       per_page: 1
     })).roles[0] ?? null;
@@ -404,18 +404,18 @@ function fe(t) {
   return {
     entityHooks: {
       resourceServers: s,
-      roles: f
+      roles: d
     },
     tenantHooks: {
-      async afterCreate(p, g) {
+      async afterCreate(m, p) {
         const h = [
-          o == null ? void 0 : o.afterCreate,
-          (u == null ? void 0 : u.afterCreate) ?? (i == null ? void 0 : i.afterCreate)
+          i == null ? void 0 : i.afterCreate,
+          (g == null ? void 0 : g.afterCreate) ?? (l == null ? void 0 : l.afterCreate)
         ], w = [];
         for (const y of h)
           if (y)
             try {
-              await y(p, g);
+              await y(m, p);
             } catch (T) {
               w.push(T instanceof Error ? T : new Error(String(T)));
             }
@@ -455,7 +455,7 @@ var b = class extends Error {
     });
   }
 };
-function M(t, e) {
+function q(t, e) {
   const n = new re();
   return n.openapi(
     R({
@@ -463,7 +463,7 @@ function M(t, e) {
       method: "get",
       path: "/",
       request: {
-        query: ee
+        query: Z
       },
       security: [
         {
@@ -475,7 +475,7 @@ function M(t, e) {
           content: {
             "application/json": {
               schema: S.object({
-                tenants: S.array(N),
+                tenants: S.array(k),
                 start: S.number().optional(),
                 limit: S.number().optional(),
                 length: S.number().optional()
@@ -487,72 +487,72 @@ function M(t, e) {
       }
     }),
     async (r) => {
-      var p, g, h, w, y, T;
-      const a = r.req.valid("query"), { page: c, per_page: d, include_totals: s, q: f } = a, o = r.var.user, i = (o == null ? void 0 : o.permissions) || [];
-      if (i.includes("auth:read") || i.includes("admin:organizations")) {
-        const A = await r.env.data.tenants.list({
-          page: c,
-          per_page: d,
+      var m, p, h, w, y, T;
+      const a = r.req.valid("query"), { page: o, per_page: c, include_totals: s, q: d } = a, i = r.var.user, l = (i == null ? void 0 : i.permissions) || [];
+      if (l.includes("auth:read") || l.includes("admin:organizations")) {
+        const C = await r.env.data.tenants.list({
+          page: o,
+          per_page: c,
           include_totals: s,
-          q: f
+          q: d
         });
         return s ? r.json({
-          tenants: A.tenants,
-          start: ((p = A.totals) == null ? void 0 : p.start) ?? 0,
-          limit: ((g = A.totals) == null ? void 0 : g.limit) ?? d,
-          length: A.tenants.length
-        }) : r.json({ tenants: A.tenants });
+          tenants: C.tenants,
+          start: ((m = C.totals) == null ? void 0 : m.start) ?? 0,
+          limit: ((p = C.totals) == null ? void 0 : p.limit) ?? c,
+          length: C.tenants.length
+        }) : r.json({ tenants: C.tenants });
       }
-      const l = ((h = t.accessControl) == null ? void 0 : h.controlPlaneTenantId) ?? ((w = r.env.data.multiTenancyConfig) == null ? void 0 : w.controlPlaneTenantId);
-      if (l && (o != null && o.sub)) {
-        const _ = (await F(
+      const u = ((h = t.accessControl) == null ? void 0 : h.controlPlaneTenantId) ?? ((w = r.env.data.multiTenancyConfig) == null ? void 0 : w.controlPlaneTenantId);
+      if (u && (i != null && i.sub)) {
+        const P = (await F(
           (z) => r.env.data.userOrganizations.listUserOrganizations(
-            l,
-            o.sub,
+            u,
+            i.sub,
             z
           ),
           "organizations"
         )).map((z) => z.name);
-        if (_.length === 0)
+        if (P.length === 0)
           return s ? r.json({
             tenants: [],
             start: 0,
-            limit: d ?? 50,
+            limit: c ?? 50,
             length: 0
           }) : r.json({ tenants: [] });
-        const v = _.length, P = c ?? 0, C = d ?? 50, $ = P * C, I = _.slice($, $ + C);
+        const v = P.length, _ = o ?? 0, A = c ?? 50, $ = _ * A, I = P.slice($, $ + A);
         if (I.length === 0)
           return s ? r.json({
             tenants: [],
             start: $,
-            limit: C,
+            limit: A,
             length: v
           }) : r.json({ tenants: [] });
-        const j = I.map((z) => `id:${z}`).join(" OR "), J = f ? `(${j}) AND (${f})` : j, E = await r.env.data.tenants.list({
-          q: J,
-          per_page: C,
+        const E = I.map((z) => `id:${z}`).join(" OR "), V = d ? `(${E}) AND (${d})` : E, N = await r.env.data.tenants.list({
+          q: V,
+          per_page: A,
           include_totals: !1
           // We calculate totals from accessibleTenantIds
         });
         return s ? r.json({
-          tenants: E.tenants,
+          tenants: N.tenants,
           start: $,
-          limit: C,
+          limit: A,
           length: v
-        }) : r.json({ tenants: E.tenants });
+        }) : r.json({ tenants: N.tenants });
       }
-      const m = await r.env.data.tenants.list({
-        page: c,
-        per_page: d,
+      const f = await r.env.data.tenants.list({
+        page: o,
+        per_page: c,
         include_totals: s,
-        q: f
+        q: d
       });
       return s ? r.json({
-        tenants: m.tenants,
-        start: ((y = m.totals) == null ? void 0 : y.start) ?? 0,
-        limit: ((T = m.totals) == null ? void 0 : T.limit) ?? d,
-        length: m.tenants.length
-      }) : r.json({ tenants: m.tenants });
+        tenants: f.tenants,
+        start: ((y = f.totals) == null ? void 0 : y.start) ?? 0,
+        limit: ((T = f.totals) == null ? void 0 : T.limit) ?? c,
+        length: f.tenants.length
+      }) : r.json({ tenants: f.tenants });
     }
   ), n.openapi(
     R({
@@ -563,7 +563,7 @@ function M(t, e) {
         body: {
           content: {
             "application/json": {
-              schema: te
+              schema: x
             }
           }
         }
@@ -577,7 +577,7 @@ function M(t, e) {
         201: {
           content: {
             "application/json": {
-              schema: N
+              schema: k
             }
           },
           description: "Tenant created"
@@ -591,20 +591,20 @@ function M(t, e) {
       }
     }),
     async (r) => {
-      var f, o;
+      var d, i;
       const a = r.var.user;
       if (!(a != null && a.sub))
         throw new b(401, {
           message: "Authentication required to create tenants"
         });
-      let c = r.req.valid("json");
-      const d = {
+      let o = r.req.valid("json");
+      const c = {
         adapters: r.env.data,
         ctx: r
       };
-      (f = e.tenants) != null && f.beforeCreate && (c = await e.tenants.beforeCreate(d, c));
-      const s = await r.env.data.tenants.create(c);
-      return (o = e.tenants) != null && o.afterCreate && await e.tenants.afterCreate(d, s), r.json(s, 201);
+      (d = e.tenants) != null && d.beforeCreate && (o = await e.tenants.beforeCreate(c, o));
+      const s = await r.env.data.tenants.create(o);
+      return (i = e.tenants) != null && i.afterCreate && await e.tenants.afterCreate(c, s), r.json(s, 201);
     }
   ), n.openapi(
     R({
@@ -634,26 +634,26 @@ function M(t, e) {
       }
     }),
     async (r) => {
-      var f, o, i, u;
-      const { id: a } = r.req.valid("param"), c = ((f = t.accessControl) == null ? void 0 : f.controlPlaneTenantId) ?? ((o = r.env.data.multiTenancyConfig) == null ? void 0 : o.controlPlaneTenantId);
-      if (c) {
-        const l = r.var.user;
-        if (!(l != null && l.sub))
+      var d, i, l, g;
+      const { id: a } = r.req.valid("param"), o = ((d = t.accessControl) == null ? void 0 : d.controlPlaneTenantId) ?? ((i = r.env.data.multiTenancyConfig) == null ? void 0 : i.controlPlaneTenantId);
+      if (o) {
+        const u = r.var.user;
+        if (!(u != null && u.sub))
           throw new b(401, {
             message: "Authentication required"
           });
-        if (a === c)
+        if (a === o)
           throw new b(403, {
             message: "Cannot delete the control plane"
           });
         if (!(await F(
-          (g) => r.env.data.userOrganizations.listUserOrganizations(
-            c,
-            l.sub,
-            g
+          (p) => r.env.data.userOrganizations.listUserOrganizations(
+            o,
+            u.sub,
+            p
           ),
           "organizations"
-        )).some((g) => g.name === a))
+        )).some((p) => p.name === a))
           throw new b(403, {
             message: "Access denied to this tenant"
           });
@@ -666,7 +666,7 @@ function M(t, e) {
         adapters: r.env.data,
         ctx: r
       };
-      return (i = e.tenants) != null && i.beforeDelete && await e.tenants.beforeDelete(s, a), await r.env.data.tenants.remove(a), (u = e.tenants) != null && u.afterDelete && await e.tenants.afterDelete(s, a), r.body(null, 204);
+      return (l = e.tenants) != null && l.beforeDelete && await e.tenants.beforeDelete(s, a), await r.env.data.tenants.remove(a), (g = e.tenants) != null && g.afterDelete && await e.tenants.afterDelete(s, a), r.body(null, 204);
     }
   ), n;
 }
@@ -686,7 +686,7 @@ function me(t) {
   }
   return null;
 }
-async function pe(t, e, n) {
+async function ge(t, e, n) {
   try {
     switch (n.type) {
       case "resource_server": {
@@ -708,7 +708,7 @@ async function pe(t, e, n) {
     return !1;
   }
 }
-function ge(t) {
+function pe(t) {
   return {
     resource_server: "resource server",
     role: "role",
@@ -725,9 +725,9 @@ function we() {
     const r = t.var.tenant_id || t.req.header("x-tenant-id") || t.req.header("tenant-id");
     if (!r)
       return e();
-    if (await pe(t.env.data, r, n))
+    if (await ge(t.env.data, r, n))
       throw new b(403, {
-        message: `This ${ge(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
+        message: `This ${pe(n.type)} is a system resource and cannot be modified. Make changes in the control plane instead.`
       });
     return e();
   };
@@ -737,14 +737,29 @@ const ye = [
   "app_secret",
   "twilio_token"
 ];
-function V(t) {
+function he(t) {
   if (!t) return t;
   const e = { ...t };
   for (const n of ye)
     delete e[n];
   return e;
 }
-function he(t, e) {
+function D(t, e, n) {
+  const r = e.find(
+    (c) => c.strategy === t.strategy
+  );
+  if (!(r != null && r.options))
+    return t;
+  const a = ee.passthrough().parse({
+    ...r,
+    ...t
+  }), o = n ? he(r.options) : r.options;
+  return a.options = te.passthrough().parse({
+    ...o || {},
+    ...t.options
+  }), a;
+}
+function ve(t, e) {
   const {
     controlPlaneTenantId: n,
     controlPlaneClientId: r,
@@ -759,85 +774,90 @@ function he(t, e) {
     },
     connections: {
       ...t.connections,
-      get: async (c, d) => {
-        var l;
+      get: async (o, c) => {
         const s = await t.connections.get(
-          c,
-          d
+          o,
+          c
         );
-        if (!s || !n || c === n)
+        if (!s || !n || o === n)
           return s;
-        const o = (l = (await t.connections.list(n)).connections) == null ? void 0 : l.find(
-          (m) => m.strategy === s.strategy
+        const d = await t.connections.list(n);
+        return D(
+          s,
+          d.connections || [],
+          a
         );
-        if (!(o != null && o.options))
-          return s;
-        const i = k.parse({
-          ...o,
-          ...s
-        }), u = a ? V(o.options) : o.options;
-        return i.options = H.parse({
-          ...u || {},
-          ...s.options
-        }), i;
       },
-      list: async (c, d) => {
-        const s = await t.connections.list(c, d);
-        if (!n || c === n)
+      list: async (o, c) => {
+        const s = await t.connections.list(o, c);
+        if (!n || o === n)
           return s;
-        const f = await t.connections.list(n), o = s.connections.map((i) => {
-          var p;
-          const u = (p = f.connections) == null ? void 0 : p.find(
-            (g) => g.strategy === i.strategy
-          );
-          if (!(u != null && u.options))
-            return i;
-          const l = k.parse({
-            ...u,
-            ...i
-          }), m = a ? V(u.options) : u.options;
-          return l.options = H.parse({
-            ...m || {},
-            ...i.options
-          }), l;
-        });
+        const d = await t.connections.list(n), i = s.connections.map(
+          (l) => D(
+            l,
+            d.connections || [],
+            a
+          )
+        );
         return {
           ...s,
-          connections: o
+          connections: i
         };
       }
+    },
+    clientConnections: {
+      ...t.clientConnections,
+      listByClient: async (o, c) => {
+        let s = await t.clientConnections.listByClient(
+          o,
+          c
+        );
+        if (s.length === 0 && (s = (await t.connections.list(o)).connections || []), !n || o === n)
+          return s;
+        const d = await t.connections.list(n);
+        return s.map(
+          (i) => D(
+            i,
+            d.connections || [],
+            a
+          )
+        );
+      }
+    },
+    emailProviders: {
+      ...t.emailProviders,
+      get: async (o) => {
+        const c = await t.emailProviders.get(o);
+        return c || (!n || o === n ? null : t.emailProviders.get(n));
+      }
     }
     // Note: Additional adapters can be extended here for runtime fallback:
     // - promptSettings: Fall back to control plane prompts
     // - branding: Fall back to control plane branding/themes
-    // - emailProviders: Fall back to control plane SMTP settings
-    //
-    // For now, we pass through other adapters unchanged.
-    // They remain part of ...baseAdapters and can be properly wrapped by caching.
   };
 }
-function D(t, e) {
-  return he(t, e);
+function M(t, e) {
+  return ve(t, e);
 }
-function ve(t) {
+function Te(t) {
   return async (e, n) => {
     const r = e.var.user;
     return (r == null ? void 0 : r.tenant_id) === t && r.org_name && e.set("tenant_id", r.org_name), n();
   };
 }
-function Te(t) {
+function Ce(t) {
   return async (e, n) => {
     if (!t.accessControl)
       return n();
-    const { controlPlaneTenantId: r } = t.accessControl, a = e.var.org_name, c = e.var.organization_id, d = a || c;
+    const { controlPlaneTenantId: r } = t.accessControl, a = e.var.org_name, o = e.var.organization_id, c = a || o;
     let s = e.var.tenant_id;
-    const f = e.var.user, i = (f != null && f.aud ? Array.isArray(f.aud) ? f.aud : [f.aud] : []).includes(W);
-    if (!s && d && i && (e.set("tenant_id", d), s = d), !s)
+    const d = e.var.user, l = (d != null && d.aud ? Array.isArray(d.aud) ? d.aud : [d.aud] : []).includes(K);
+    if (!s && c && l && (e.set("tenant_id", c), s = c), !s)
       throw new b(400, {
         message: "Tenant ID not found in request"
       });
     if (!se(
-      c,
+      o,
       s,
       r,
       a
@@ -848,39 +868,39 @@ function Te(t) {
     return n();
   };
 }
-function Ae(t) {
+function Pe(t) {
   return async (e, n) => {
     if (!t.subdomainRouting)
       return n();
     const {
       baseDomain: r,
       reservedSubdomains: a = [],
-      resolveSubdomain: c
-    } = t.subdomainRouting, d = e.req.header("host") || "";
+      resolveSubdomain: o
+    } = t.subdomainRouting, c = e.req.header("host") || "";
     let s = null;
-    if (d.endsWith(r)) {
-      const o = d.slice(0, -(r.length + 1));
-      o && !o.includes(".") && (s = o);
+    if (c.endsWith(r)) {
+      const i = c.slice(0, -(r.length + 1));
+      i && !i.includes(".") && (s = i);
     }
     if (s && a.includes(s) && (s = null), !s)
       return t.accessControl && e.set("tenant_id", t.accessControl.controlPlaneTenantId), n();
-    let f = null;
-    if (c)
-      f = await c(s);
+    let d = null;
+    if (o)
+      d = await o(s);
     else if (t.subdomainRouting.useOrganizations !== !1 && t.accessControl)
       try {
-        const o = await e.env.data.organizations.get(
+        const i = await e.env.data.organizations.get(
           t.accessControl.controlPlaneTenantId,
           s
         );
-        o && (f = o.id);
+        i && (d = i.id);
       } catch {
       }
-    if (!f)
+    if (!d)
       throw new b(404, {
         message: `Tenant not found for subdomain: ${s}`
       });
-    return e.set("tenant_id", f), n();
+    return e.set("tenant_id", d), n();
   };
 }
 function _e(t) {
@@ -906,14 +926,14 @@ function _e(t) {
     return n();
   };
 }
-function Q(t) {
-  const e = Ae(t), n = Te(t), r = _e(t);
-  return async (a, c) => (await e(a, async () => {
+function W(t) {
+  const e = Pe(t), n = Ce(t), r = _e(t);
+  return async (a, o) => (await e(a, async () => {
   }), await n(a, async () => {
   }), await r(a, async () => {
-  }), c());
+  }), o());
 }
-function $e(t) {
+function ze(t) {
   const {
     dataAdapter: e,
     controlPlane: n,
@@ -921,80 +941,80 @@ function $e(t) {
       tenantId: r = "control_plane",
       clientId: a
     } = {},
-    sync: c = { resourceServers: !0, roles: !0 },
-    defaultPermissions: d = ["tenant:admin"],
+    sync: o = { resourceServers: !0, roles: !0 },
+    defaultPermissions: c = ["tenant:admin"],
     requireOrganizationMatch: s = !1,
-    managementApiExtensions: f = [],
-    entityHooks: o,
-    getChildTenantIds: i,
-    getAdapters: u,
-    ...l
+    managementApiExtensions: d = [],
+    entityHooks: i,
+    getChildTenantIds: l,
+    getAdapters: g,
+    ...u
   } = t;
-  let m = e, p = e;
-  n && (m = D(e, {
+  let f = e, m = e;
+  n && (f = M(e, {
     controlPlaneTenantId: r,
     controlPlaneClientId: a
-  }), p = D(e, {
+  }), m = M(e, {
     controlPlaneTenantId: r,
     controlPlaneClientId: a,
     excludeSensitiveFields: !0
   }));
-  const g = c !== !1, h = g ? {
-    resourceServers: c.resourceServers ?? !0,
-    roles: c.roles ?? !0
+  const p = o !== !1, h = p ? {
+    resourceServers: o.resourceServers ?? !0,
+    roles: o.roles ?? !0
   } : { resourceServers: !1, roles: !1 }, T = {
     controlPlaneTenantId: r,
-    getChildTenantIds: i ?? (async () => (await F(
-      (I) => m.tenants.list(I),
+    getChildTenantIds: l ?? (async () => (await F(
+      (I) => f.tenants.list(I),
       "tenants",
       { cursorField: "id", pageSize: 100 }
     )).filter((I) => I.id !== r).map((I) => I.id)),
-    getAdapters: u ?? (async () => m),
-    getControlPlaneAdapters: async () => m,
+    getAdapters: g ?? (async () => f),
+    getControlPlaneAdapters: async () => f,
     sync: h
-  }, { entityHooks: A, tenantHooks: _ } = fe(T), v = {
+  }, { entityHooks: C, tenantHooks: P } = fe(T), v = {
     resourceServers: [
-      A.resourceServers,
-      ...(o == null ? void 0 : o.resourceServers) ?? []
+      C.resourceServers,
+      ...(i == null ? void 0 : i.resourceServers) ?? []
     ],
-    roles: [A.roles, ...(o == null ? void 0 : o.roles) ?? []],
-    connections: (o == null ? void 0 : o.connections) ?? [],
-    tenants: (o == null ? void 0 : o.tenants) ?? [],
-    rolePermissions: (o == null ? void 0 : o.rolePermissions) ?? []
-  }, P = M(
+    roles: [C.roles, ...(i == null ? void 0 : i.roles) ?? []],
+    connections: (i == null ? void 0 : i.connections) ?? [],
+    tenants: (i == null ? void 0 : i.tenants) ?? [],
+    rolePermissions: (i == null ? void 0 : i.rolePermissions) ?? []
+  }, _ = q(
     {
       accessControl: {
         controlPlaneTenantId: r,
         requireOrganizationMatch: s,
-        defaultPermissions: d
+        defaultPermissions: c
       }
     },
-    { tenants: _ }
-  ), { app: C } = ne({
-    dataAdapter: m,
-    managementDataAdapter: p,
-    ...l,
+    { tenants: P }
+  ), { app: A } = ne({
+    dataAdapter: f,
+    managementDataAdapter: m,
+    ...u,
     entityHooks: v,
     managementApiExtensions: [
-      ...f,
-      { path: "/tenants", router: P }
+      ...d,
+      { path: "/tenants", router: _ }
     ]
   });
-  return C.use("/api/v2/*", ve(r)), g && C.use("/api/v2/*", we()), { app: C, controlPlaneTenantId: r };
+  return A.use("/api/v2/*", Te(r)), p && A.use("/api/v2/*", we()), { app: A, controlPlaneTenantId: r };
 }
-function ze(t) {
-  const e = q(t);
+function Fe(t) {
+  const e = j(t);
   return {
     name: "multi-tenancy",
     // Apply multi-tenancy middleware for subdomain routing, database resolution, etc.
-    middleware: Q(t),
+    middleware: W(t),
     // Provide lifecycle hooks
     hooks: e,
     // Mount tenant management routes
     routes: [
       {
         path: "/management",
-        handler: M(t, e)
+        handler: q(t, e)
       }
     ],
     // Called when plugin is registered
@@ -1007,7 +1027,7 @@ function ze(t) {
     }
   };
 }
-function q(t) {
+function j(t) {
   const e = t.accessControl ? ae(t.accessControl) : {}, n = t.databaseIsolation ? oe(t.databaseIsolation) : {}, r = ce(t);
   return {
     ...e,
@@ -1015,15 +1035,15 @@ function q(t) {
     tenants: r
   };
 }
-function Pe(t) {
-  const e = new Z(), n = q(t);
-  return e.route("/tenants", M(t, n)), e;
+function Ae(t) {
+  const e = new X(), n = j(t);
+  return e.route("/tenants", q(t, n)), e;
 }
-function Fe(t) {
+function Oe(t) {
   return {
-    hooks: q(t),
-    middleware: Q(t),
-    app: Pe(t),
+    hooks: j(t),
+    middleware: W(t),
+    app: Ae(t),
     config: t,
     /**
      * Wraps data adapters with runtime fallback from the control plane.
@@ -1035,7 +1055,7 @@ function Fe(t) {
      */
     wrapAdapters: (e, n) => {
       var r;
-      return D(e, {
+      return M(e, {
         controlPlaneTenantId: (r = t.accessControl) == null ? void 0 : r.controlPlaneTenantId,
         controlPlaneClientId: n == null ? void 0 : n.controlPlaneClientId
       });
@@ -1044,22 +1064,22 @@ function Fe(t) {
 }
 export {
   ae as createAccessControlHooks,
-  Te as createAccessControlMiddleware,
-  ve as createControlPlaneTenantMiddleware,
+  Ce as createAccessControlMiddleware,
+  Te as createControlPlaneTenantMiddleware,
   oe as createDatabaseHooks,
   _e as createDatabaseMiddleware,
-  Pe as createMultiTenancy,
-  q as createMultiTenancyHooks,
-  Q as createMultiTenancyMiddleware,
-  ze as createMultiTenancyPlugin,
+  Ae as createMultiTenancy,
+  j as createMultiTenancyHooks,
+  W as createMultiTenancyMiddleware,
+  Fe as createMultiTenancyPlugin,
   we as createProtectSyncedMiddleware,
   ce as createProvisioningHooks,
-  he as createRuntimeFallbackAdapter,
-  Ae as createSubdomainMiddleware,
+  ve as createRuntimeFallbackAdapter,
+  Pe as createSubdomainMiddleware,
   fe as createSyncHooks,
-  M as createTenantsOpenAPIRouter,
-  $e as initMultiTenant,
-  Fe as setupMultiTenancy,
+  q as createTenantsOpenAPIRouter,
+  ze as initMultiTenant,
+  Oe as setupMultiTenancy,
   se as validateTenantAccess,
-  D as withRuntimeFallback
+  M as withRuntimeFallback
 };

package/dist/types/middleware/settings-inheritance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAIb,MAAM,UAAU,CAAC;AA+BlB;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CA0Hd;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}
+{"version":3,"file":"settings-inheritance.d.ts","sourceRoot":"","sources":["../../../src/middleware/settings-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAIb,MAAM,UAAU,CAAC;AAoElB;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAwId;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,qBAAqB,GAC5B,YAAY,CAEd"}

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "14.7.0",
+  "version": "14.8.0",
   "description": "Multi-tenancy support for AuthHero with organization-based access control and per-tenant database isolation",
   "files": [
     "dist"
@@ -36,9 +36,9 @@
     "typescript": "^5.6.0",
     "vite": "^6.0.0",
     "vitest": "^2.1.0",
-    "@authhero/kysely-adapter": "10.88.0",
-    "authhero": "4.23.0",
-    "@authhero/adapter-interfaces": "0.127.0"
+    "@authhero/kysely-adapter": "10.91.0",
+    "authhero": "4.27.0",
+    "@authhero/adapter-interfaces": "0.129.0"
   },
   "dependencies": {
     "zod": "^3.24.0"