@authyon/auth 0.2.0-beta.21 → 0.2.0-beta.22

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-BTcayvkM.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as AcceptOrganizationInviteInput, h as Activity, i as Approval, j as ApprovalAssurance, k as ApprovalPayload, l as ApprovalStatus, m as ApprovalWebAuthnOptions, n as AuthEvent, o as AuthState, p as AuthStateListener, q as AuthenticatorSetup, r as AuthyonAbility, s as AuthyonAbilityBuilder, t as AuthyonAbilityOptions, u as AuthyonClientOptions, v as AuthyonPermissionSource, w as AuthyonSessionController, C as ConfirmApprovalInput, x as CreateOrganizationInput, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteMemberInput, L as LoggingHttpAdapter, E as LoginInput, G as LoginResult, O as Organization, J as OrganizationInvite, K as OrganizationInviteAccepted, M as OrganizationInviteInput, N as OrganizationInviteIssued, P as OrganizationInvitePreview, Q as OrganizationInviteStatus, R as OrganizationMember, S as Paged, U as PaginationOptions, V as PasswordResetCompleted, W as PasswordResetPreview, X as PasswordResetRequestOptions, Y as PermissionGroup, Z as RegisterInput, _ as Role, $ as SecurityMethods, a0 as Session, a1 as SessionControllerOptions, a2 as SessionInfo, a3 as SessionSnapshot, a4 as SessionSnapshotListener, a5 as SessionStatus, a6 as SsoProvider, a7 as SubjectApprovals, a8 as SubjectSecurity, a9 as TwoFactorChallenge, aa as TwoFactorMethod, ab as TwoFactorStatus, ac as User, ad as ValidateResult, ae as VerifyTwoFactorInput, af as WebAuthnAssertion, ag as WebAuthnCeremonyStart, ah as WebAuthnCredential, ai as createAuthyonAbility, aj as createAuthyonRules, ak as createClient, al as hasPermission, am as hasPermissionGroup } from './ability-BTcayvkM.js';
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-DjEMCVjx.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as AcceptOrganizationInviteInput, h as Activity, i as Approval, j as ApprovalAssurance, k as ApprovalPayload, l as ApprovalStatus, m as ApprovalWebAuthnOptions, n as AuthEvent, o as AuthState, p as AuthStateListener, q as AuthenticatorSetup, r as AuthyonAbility, s as AuthyonAbilityBuilder, t as AuthyonAbilityOptions, u as AuthyonClientOptions, v as AuthyonPermissionSource, w as AuthyonSessionController, C as ConfirmApprovalInput, x as CreateOrganizationInput, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteMemberInput, L as LoggingHttpAdapter, E as LoginInput, G as LoginResult, O as Organization, J as OrganizationInvite, K as OrganizationInviteAccepted, M as OrganizationInviteInput, N as OrganizationInviteIssued, P as OrganizationInvitePreview, Q as OrganizationInviteStatus, R as OrganizationMember, S as Paged, U as PaginationOptions, V as PasswordResetCompleted, W as PasswordResetPreview, X as PasswordResetRequestOptions, Y as PermissionGroup, Z as RegisterInput, _ as Role, $ as SecurityMethods, a0 as Session, a1 as SessionControllerOptions, a2 as SessionInfo, a3 as SessionSnapshot, a4 as SessionSnapshotListener, a5 as SessionStatus, a6 as SsoProvider, a7 as SubjectApprovals, a8 as SubjectSecurity, a9 as TwoFactorChallenge, aa as TwoFactorMethod, ab as TwoFactorStatus, ac as User, ad as ValidateResult, ae as VerifyTwoFactorInput, af as WebAuthnAssertion, ag as WebAuthnCeremonyStart, ah as WebAuthnCredential, ai as createAuthyonAbility, aj as createAuthyonRules, ak as createClient, al as hasPermission, am as hasPermissionGroup } from './ability-DjEMCVjx.js';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";
@@ -99,4 +99,54 @@ declare function createMemoryStorage(): TokenStorage;
 declare function createLocalStorage(key?: string): TokenStorage;
 declare function createDefaultStorage(): TokenStorage;
 
-export { AuthyonClient, AuthyonClientBuilder, AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, TokenStorage, createDefaultStorage, createLocalStorage, createMemoryStorage };
+/**
+ * The permission values the tenant surface checks, as constants.
+ *
+ * They are strings on the wire and nothing forces you through here — the point
+ * is that a rename shows up as a type error instead of as a 403 nobody can
+ * explain. `tenants:settings:manage` is exactly that case: it used to be
+ * written `tenants:manage`, a two-segment value the API could not even store,
+ * so the endpoint requiring it refused every caller.
+ */
+declare const TenantPermissions: {
+    /** Rename the tenant and change its settings. */
+    readonly SettingsManage: "tenants:settings:manage";
+    /** Invite an address to the tenant. */
+    readonly MembersInvite: "tenants:members:invite";
+    /** Remove a member from the tenant. */
+    readonly MembersRemove: "tenants:members:remove";
+};
+/**
+ * What lets a member of one tenant reach the tenants beneath it.
+ *
+ * A separate domain, not a suffix on `tenants:…`, and the reason is worth
+ * knowing before you grant one: permissions match per segment, so naming these
+ * `tenants:tree:manage` would have handed every role already holding
+ * `tenants:*:*` power over the whole subtree the day the hierarchy shipped — a
+ * widening that appears in no diff. `subtenants:…` is only covered by `*:*:*`,
+ * which is explicit superuser.
+ *
+ * Reaching down is opt-in at every level: holding `tenants:settings:manage` on
+ * a parent grants nothing below it, and each of these is granted at the node
+ * the caller belongs to, never at the target.
+ */
+declare const SubtenantPermissions: {
+    /** Read any tenant below one you belong to. */
+    readonly TreeRead: "subtenants:tree:read";
+    /** Rename a tenant below yours, and add or remove its members. */
+    readonly TreeManage: "subtenants:tree:manage";
+    /** Create a tenant underneath one you belong to. */
+    readonly TreeCreate: "subtenants:tree:create";
+    /**
+     * Make a tenant below yours the ACTIVE tenant of the session — acting inside
+     * it rather than on it from outside. Deliberately not the same permission as
+     * {@link SubtenantPermissions.TreeManage}: administering a sub-tenant through
+     * the management endpoints and operating as that sub-tenant are different
+     * powers, and granting the first should not hand over the second.
+     */
+    readonly TreeSwitch: "subtenants:tree:switch";
+};
+type TenantPermission = (typeof TenantPermissions)[keyof typeof TenantPermissions];
+type SubtenantPermission = (typeof SubtenantPermissions)[keyof typeof SubtenantPermissions];
+
+export { AuthyonClient, AuthyonClientBuilder, AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, type SubtenantPermission, SubtenantPermissions, type TenantPermission, TenantPermissions, TokenStorage, createDefaultStorage, createLocalStorage, createMemoryStorage };

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   createAuthyonRules,
   hasPermission,
   hasPermissionGroup
-} from "./chunk-3XJY6BCI.js";
+} from "./chunk-IX6U6A72.js";
 
 // ../../internal/core/security/approvals.ts
 function path(id, suffix = "") {
@@ -442,9 +442,11 @@ var JsonHttpClient = class {
 };
 
 // ../../internal/core/http/clientIp.ts
+var CLIENT_IP_HEADER = "X-Authyon-Client-Ip";
 function clientIpHeaders(context) {
   if (!context?.clientIp) return {};
-  return { "X-Forwarded-For": normalizeClientIp(context.clientIp) };
+  const ip = normalizeClientIp(context.clientIp);
+  return { "X-Forwarded-For": ip, [CLIENT_IP_HEADER]: ip };
 }
 function normalizeClientIp(value) {
   let ip = value.trim();
@@ -573,26 +575,59 @@ var AuthyonClient = class {
     };
     // ── Organization ─────────────────────────────────────────────────────────
     this.organization = {
-      /** GET /auth/tenants — filterable list of organization memberships. */
+      /**
+       * GET /auth/tenants — filterable list of organization memberships.
+       *
+       * Also lists the organizations below them that the user may switch into
+       * without being a member, marked `inherited` — only the ones that actually
+       * carry `subtenants:tree:switch`, so the switcher never offers an
+       * organization the switch would then refuse. `depth` indents the list into
+       * the tree it describes.
+       */
       list: (params = {}) => this.request(appendQuery("/auth/tenants", params), { bearer: true }),
       /**
        * POST /auth/tenants — creates an organization owned by the signed-in
        * user (only available when self-service organization creation is
        * enabled for the environment).
+       *
+       * `parentTenantId` nests it under one the user already belongs to, which
+       * needs `subtenants:tree:create` there. The creator lands as the effective
+       * owner either way, with `tenants:settings:manage`,
+       * `tenants:members:invite` and `tenants:members:remove` granted directly
+       * inside the new organization.
        */
       create: (params = {}) => this.request("/auth/tenants", { method: "POST", bearer: true, body: params }),
       /** GET /auth/tenants/{organizationId} — fetch one of the user's organizations by id. */
       get: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}`, { bearer: true }),
       /**
        * PATCH /auth/tenants/{organizationId} — renames the organization.
-       * Requires the `tenants:manage` custom permission on it.
+       *
+       * Requires the `tenants:settings:manage` custom permission on it, or
+       * `subtenants:tree:manage` on an organization above it. The value was
+       * spelled `tenants:manage` before 2026-10-31 — two segments, which the API
+       * could not store, so the endpoint refused everyone who had been granted
+       * it.
        */
       rename: (organizationId, name) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}`, {
         method: "PATCH",
         bearer: true,
         body: { name }
       }),
-      /** POST /auth/switch-tenant — issues a fresh token scoped to the new organization. */
+      /**
+       * POST /auth/switch-tenant — issues a fresh token scoped to the new
+       * organization.
+       *
+       * Membership is enough for one of the user's own organizations. Descending
+       * into one below it takes `subtenants:tree:switch` at the organization they
+       * belong to — deliberately not the same permission as administering a
+       * sub-organization from the outside, since operating AS it is the larger of
+       * the two powers. The grants then travel from the node the user belongs to,
+       * and the token says so in its `tenant.via`.
+       *
+       * Refusals: `tenant.outside_scope` (no path down to it),
+       * `tenant.ancestor_disabled`, and `tenant.path_stale` when the tree moved
+       * under a session — sign-in again rather than retrying.
+       */
       switch: (organizationSlug) => this.request("/auth/switch-tenant", {
         method: "POST",
         bearer: true,
@@ -906,7 +941,21 @@ var AuthyonClient = class {
     return this.http.parse(response);
   }
   // ── Auth flows ───────────────────────────────────────────────────────────
-  /** POST /auth/register — creates a new user (rate-limited to 20/hour per IP). */
+  /**
+   * POST /auth/register — creates a new user (rate-limited to 20/hour per IP).
+   *
+   * An environment may close public sign-up, and then this route answers as
+   * though it were not mapped: **404 with no body**, so the error carries
+   * status 404 and the code `unknown`. The SDK does not relabel it, because a
+   * wrong `baseUrl` looks exactly the same from here and guessing would send
+   * you after the wrong bug — check the environment's setting in the console
+   * and the URL you configured. Accounts in a closed environment are created
+   * by your backend instead, through `environment.users.create()` in
+   * `@authyon/server`, which already needs the `users:write` scope.
+   *
+   * It gates creation only. Everyone who already has an account signs in as
+   * before, and magic link and social sign-up keep their own switches.
+   */
   async register(params) {
     return this.request("/auth/register", { method: "POST", body: params });
   }
@@ -1066,6 +1115,32 @@ var AuthyonClientBuilder = class {
     return new AuthyonClient({ ...this.options });
   }
 };
+
+// ../../internal/core/authorization/tenantPermissions.ts
+var TenantPermissions = {
+  /** Rename the tenant and change its settings. */
+  SettingsManage: "tenants:settings:manage",
+  /** Invite an address to the tenant. */
+  MembersInvite: "tenants:members:invite",
+  /** Remove a member from the tenant. */
+  MembersRemove: "tenants:members:remove"
+};
+var SubtenantPermissions = {
+  /** Read any tenant below one you belong to. */
+  TreeRead: "subtenants:tree:read",
+  /** Rename a tenant below yours, and add or remove its members. */
+  TreeManage: "subtenants:tree:manage",
+  /** Create a tenant underneath one you belong to. */
+  TreeCreate: "subtenants:tree:create",
+  /**
+   * Make a tenant below yours the ACTIVE tenant of the session — acting inside
+   * it rather than on it from outside. Deliberately not the same permission as
+   * {@link SubtenantPermissions.TreeManage}: administering a sub-tenant through
+   * the management endpoints and operating as that sub-tenant are different
+   * powers, and granting the first should not hand over the second.
+   */
+  TreeSwitch: "subtenants:tree:switch"
+};
 export {
   AuthyonAbility,
   AuthyonAbilityBuilder,
@@ -1076,6 +1151,8 @@ export {
   ErrorCodes,
   FetchHttpAdapter,
   LoggingHttpAdapter,
+  SubtenantPermissions,
+  TenantPermissions,
   createAuthyonAbility,
   createAuthyonRules,
   createClient,

package/dist/react/index.cjs

@@ -83,13 +83,23 @@ function createAuthyonRules(source = {}, options = {}) {
     ...source.permissions ?? [],
     ...source.scope?.split(/\s+/).filter(Boolean) ?? []
   ]);
-  const rules = [...permissions].map(permissionToRule).filter(isAbilityRule);
+  const rules = [...permissions].map(grantToRule).filter(isAbilityRule);
   for (const role of /* @__PURE__ */ new Set([...source.roles ?? [], ...options.roles ?? []])) {
     rules.push(...(options.roleRules?.[role] ?? []).map(cloneRule));
   }
   rules.push(...(options.rules ?? []).map(cloneRule));
   return rules;
 }
+function grantToRule(permission) {
+  const normalized = permission.trim();
+  if (normalized && isFullWildcard(normalized)) {
+    return { action: "manage", subject: "all" };
+  }
+  return permissionToRule(normalized);
+}
+function isFullWildcard(permission) {
+  return permission.split(":").every((segment) => segment === "*");
+}
 function permissionToRule(permission) {
   const normalized = permission.trim();
   if (!normalized) return null;

package/dist/react/index.d.cts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { ac as User, a1 as SessionControllerOptions, A as AuthyonClient, a3 as SessionSnapshot, a0 as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-BTcayvkM.cjs';
-export { w as AuthyonSessionController, a4 as SessionSnapshotListener, a5 as SessionStatus } from '../ability-BTcayvkM.cjs';
+import { ac as User, a1 as SessionControllerOptions, A as AuthyonClient, a3 as SessionSnapshot, a0 as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-DjEMCVjx.cjs';
+export { w as AuthyonSessionController, a4 as SessionSnapshotListener, a5 as SessionStatus } from '../ability-DjEMCVjx.cjs';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/dist/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { ac as User, a1 as SessionControllerOptions, A as AuthyonClient, a3 as SessionSnapshot, a0 as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-BTcayvkM.js';
-export { w as AuthyonSessionController, a4 as SessionSnapshotListener, a5 as SessionStatus } from '../ability-BTcayvkM.js';
+import { ac as User, a1 as SessionControllerOptions, A as AuthyonClient, a3 as SessionSnapshot, a0 as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-DjEMCVjx.js';
+export { w as AuthyonSessionController, a4 as SessionSnapshotListener, a5 as SessionStatus } from '../ability-DjEMCVjx.js';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/dist/react/index.js

@@ -2,7 +2,7 @@
 import {
   AuthyonSessionController,
   createAuthyonAbility
-} from "../chunk-3XJY6BCI.js";
+} from "../chunk-IX6U6A72.js";
 
 // src/react/index.tsx
 import {

package/package.json

@@ -1,71 +1,71 @@
-{
-  "name": "@authyon/auth",
-  "version": "0.2.0-beta.21",
-  "description": "Authyon SDK for browsers — auth, sessions, multi-tenant and 2FA for vanilla JS/TS.",
-  "license": "MIT",
-  "type": "module",
-  "engines": {
-    "node": ">=18"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Synkestra/package-authyon.git",
-    "directory": "packages/auth"
-  },
-  "homepage": "https://authyon.com/docs",
-  "bugs": {
-    "url": "https://github.com/Synkestra/package-authyon/issues"
-  },
-  "main": "./dist/index.cjs",
-  "module": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js",
-      "require": "./dist/index.cjs",
-      "default": "./dist/index.js"
-    },
-    "./react": {
-      "types": "./dist/react/index.d.ts",
-      "import": "./dist/react/index.js",
-      "require": "./dist/react/index.cjs",
-      "default": "./dist/react/index.js"
-    }
-  },
-  "files": [
-    "dist"
-  ],
-  "sideEffects": false,
-  "publishConfig": {
-    "access": "public",
-    "provenance": true
-  },
-  "scripts": {
-    "build": "tsup src/index.ts src/react/index.tsx --format esm,cjs --dts --clean",
-    "typecheck": "tsc --noEmit",
-    "prepack": "npm run build"
-  },
-  "keywords": [
-    "authyon",
-    "auth",
-    "authentication",
-    "jwt",
-    "2fa",
-    "multi-tenant"
-  ],
-  "devDependencies": {
-    "@types/react": "^19.2.18",
-    "react": "^19.2.8",
-    "tsup": "^8.0.0",
-    "typescript": "^5.5.0"
-  },
-  "peerDependencies": {
-    "react": ">=18.2.0"
-  },
-  "peerDependenciesMeta": {
-    "react": {
-      "optional": true
-    }
-  }
-}
+{
+  "name": "@authyon/auth",
+  "version": "0.2.0-beta.22",
+  "description": "Authyon SDK for browsers — auth, sessions, multi-tenant and 2FA for vanilla JS/TS.",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Synkestra/package-authyon.git",
+    "directory": "packages/auth"
+  },
+  "homepage": "https://authyon.com/docs",
+  "bugs": {
+    "url": "https://github.com/Synkestra/package-authyon/issues"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs",
+      "default": "./dist/index.js"
+    },
+    "./react": {
+      "types": "./dist/react/index.d.ts",
+      "import": "./dist/react/index.js",
+      "require": "./dist/react/index.cjs",
+      "default": "./dist/react/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsup src/index.ts src/react/index.tsx --format esm,cjs --dts --clean",
+    "typecheck": "tsc --noEmit",
+    "prepack": "npm run build"
+  },
+  "keywords": [
+    "authyon",
+    "auth",
+    "authentication",
+    "jwt",
+    "2fa",
+    "multi-tenant"
+  ],
+  "devDependencies": {
+    "@types/react": "^19.2.18",
+    "react": "^19.2.8",
+    "tsup": "^8.0.0",
+    "typescript": "^5.5.0"
+  },
+  "peerDependencies": {
+    "react": ">=18.2.0"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  }
+}