@authyon/server 0.2.0-beta.20 → 0.2.0-beta.22

package/dist/index.js

@@ -7,11 +7,12 @@ import {
   JsonHttpClient,
   LoggingHttpAdapter,
   createSharedTransport
-} from "./chunk-TDJNBD3Z.js";
+} from "./chunk-SUL2HLRR.js";
 import {
   AuthorizationError,
   AuthyonAbility,
   AuthyonAbilityBuilder,
+  CLIENT_IP_HEADER,
   JwksTokenVerifier,
   TokenVerificationError,
   authorizeRequest,
@@ -24,7 +25,7 @@ import {
   hasPermission,
   hasPermissionGroup,
   normalizeClientIp
-} from "./chunk-NKWQMYB3.js";
+} from "./chunk-WF26WYSX.js";
 import {
   __privateAdd,
   __privateGet,
@@ -268,6 +269,11 @@ _token = new WeakMap();
 _inFlight = new WeakMap();
 
 // src/client/authyonServerClient.ts
+var ROOT_PARENT_ID = "00000000-0000-0000-0000-000000000000";
+function tenantListQuery({ parentId, ...rest }) {
+  if (parentId === void 0) return rest;
+  return { ...rest, parentId: parentId === null ? ROOT_PARENT_ID : parentId };
+}
 var _clientSecret;
 var AuthyonServerClient = class {
   constructor(options = {}) {
@@ -493,13 +499,64 @@ var AuthyonServerClient = class {
          * is found by the number, and `cnpj` alone finds every tenant carrying
          * that key. `take` defaults to 25 and is capped at 100.
          *
+         * `filter` is the structured half, and the one to reach for when more
+         * than one condition has to hold: each entry is a condition on a JSON
+         * document, they are ANDed with each other and with `search`, and they
+         * run inside the statement — so the envelope keeps describing the
+         * filtered set and you can page through it. Build them with
+         * `tenantFilter`:
+         *
+         * ```ts
+         * const page = await authyon.environment.tenants.list({
+         *   filter: [
+         *     tenantFilter.in("public.kind", ["reseller", "partner"]),
+         *     tenantFilter.in("custom.cnpj", [a, b]),
+         *   ],
+         *   take: 100,
+         * });
+         * ```
+         *
+         * `parentId` narrows the page to one level of the tree — `children()`
+         * and `roots()` below are the same call with that one option set.
+         *
          * Against an Authyon API older than 2026-10-21 this route ignored
-         * skip/take/search and answered with a bare array.
+         * skip/take/search and answered with a bare array; one older than
+         * 2026-10-22 ignores `filter` and one older than 2026-10-31 ignores
+         * `parentId`, which read as a page that is too wide rather than an error.
+         */
+        list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: tenantListQuery(params) }),
+        /**
+         * One page of a tenant's direct sub-tenants — `list()` with `parentId`.
+         *
+         * Only one level: a node's own children carry `childCount`, so a tree
+         * view asks again where that is above zero instead of reading the whole
+         * subtree to draw the first level of it.
+         */
+        children: (parentTenantId, params = {}) => this.environment.tenants.list({ ...params, parentId: parentTenantId }),
+        /**
+         * One page of the environment's root tenants — `list()` with no parent.
+         *
+         * This is the first level of the tree, and the difference from `list()`
+         * is worth keeping straight: `list()` returns every tenant at every
+         * depth, which is what a flat picker wants and what a tree view must not
+         * start from.
+         */
+        roots: (params = {}) => this.environment.tenants.list({ ...params, parentId: null }),
+        /**
+         * POST /env/tenants — create a tenant in the environment.
+         *
+         * `parentTenantId` nests it under an existing tenant. The environment's
+         * `maxTenantDepth` has to allow the level — it ships as `1`, roots only,
+         * so this answers `tenant.depth.not_allowed` until an operator raises it
+         * in the console.
          */
-        list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: params }),
-        /** POST /env/tenants — create a tenant in the environment. */
         create: (input) => this.request("/env/tenants", { method: "POST", envBearer: true, body: input }),
-        /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
+        /**
+         * GET /env/tenants/{tenantId} — fetch a tenant by id.
+         *
+         * Returns `ancestors` as well, the chain above it root first, so a
+         * breadcrumb costs this one call rather than one per level.
+         */
         get: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, { envBearer: true }),
         /** PUT /env/tenants/{tenantId} — update a tenant. */
         update: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, {
@@ -513,12 +570,23 @@ var AuthyonServerClient = class {
           envBearer: true,
           body: input
         }),
-        /** POST /env/tenants/{tenantId}/disable — disable without removing tenant data. */
+        /**
+         * POST /env/tenants/{tenantId}/disable — disable without removing tenant
+         * data.
+         *
+         * Disables the branch below it too. A sub-tenant left live under a
+         * disabled parent would go on authenticating its users, which is the one
+         * thing switching a tenant off is there to stop — so check `childCount`
+         * before calling this on a node with children.
+         */
         disable: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/disable`, {
           method: "POST",
           envBearer: true
         }),
-        /** DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant. */
+        /**
+         * DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant,
+         * and the branch below it. Same handler as `disable()`.
+         */
         delete: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, {
           method: "DELETE",
           envBearer: true
@@ -1015,6 +1083,112 @@ var AuthyonServerClientBuilder = class {
   }
 };
 _options = new WeakMap();
+
+// src/client/tenantFilters.ts
+var TENANT_FILTER_MAX_VALUES = 25;
+var TENANT_FILTER_MAX_VALUE_LENGTH = 200;
+var TENANT_FILTER_MAX_DEPTH = 3;
+var SCOPES = ["public", "private", "custom"];
+var KEY_SEGMENT = /^[A-Za-z0-9_-]{1,64}$/;
+function assertPath(path2) {
+  if (typeof path2 !== "string" || path2.length === 0) {
+    throw new RangeError("Authyon: a filter path is required, e.g. public.kind.");
+  }
+  const [scope, ...keys] = path2.split(".");
+  if (!SCOPES.includes(scope)) {
+    throw new RangeError(
+      `Authyon: unknown filter scope "${scope}" \u2014 use ${SCOPES.join(", ")} (e.g. public.kind).`
+    );
+  }
+  if (keys.length === 0) {
+    throw new RangeError(`Authyon: filter path "${path2}" needs a key after the scope.`);
+  }
+  if (keys.length > TENANT_FILTER_MAX_DEPTH) {
+    throw new RangeError(
+      `Authyon: filter path "${path2}" goes deeper than ${TENANT_FILTER_MAX_DEPTH} levels.`
+    );
+  }
+  for (const key of keys) {
+    if (!KEY_SEGMENT.test(key)) {
+      throw new RangeError(
+        `Authyon: invalid filter key "${key}" \u2014 letters, digits, "_" and "-", up to 64 characters.`
+      );
+    }
+  }
+  return path2;
+}
+function assertValue(value, forIn) {
+  if (value === void 0 || value === null) {
+    throw new RangeError("Authyon: a filter value is required.");
+  }
+  const text = String(value);
+  if (text.length === 0) {
+    throw new RangeError("Authyon: a filter value may not be empty.");
+  }
+  if (text.length > TENANT_FILTER_MAX_VALUE_LENGTH) {
+    throw new RangeError(
+      `Authyon: a filter value may hold at most ${TENANT_FILTER_MAX_VALUE_LENGTH} characters.`
+    );
+  }
+  if (text.includes(",")) {
+    throw new RangeError(
+      forIn ? "Authyon: an `in` value may not contain a comma \u2014 pass separate values instead." : "Authyon: a filter value may not contain a comma."
+    );
+  }
+  return text;
+}
+var tenantFilter = {
+  /** `public.kind:eq:reseller` — the key equals this value. */
+  eq(path2, value) {
+    return `${assertPath(path2)}:eq:${assertValue(value, false)}`;
+  },
+  /** `public.kind:in:reseller,partner` — the key equals any of these (SQL IN). */
+  in(path2, values) {
+    if (!Array.isArray(values) || values.length === 0) {
+      throw new RangeError("Authyon: `in` needs at least one value.");
+    }
+    if (values.length > TENANT_FILTER_MAX_VALUES) {
+      throw new RangeError(`Authyon: \`in\` takes at most ${TENANT_FILTER_MAX_VALUES} values.`);
+    }
+    const unique = [...new Set(values.map((value) => assertValue(value, true)))];
+    return `${assertPath(path2)}:in:${unique.join(",")}`;
+  },
+  /** `public.notes:like:nacional` — the key contains this text, case-insensitive.
+   *  The server escapes the LIKE metacharacters, so `100%` means `100%`. */
+  like(path2, text) {
+    return `${assertPath(path2)}:like:${assertValue(text, false)}`;
+  },
+  /** `custom.cnpj:exists` — the key is present, whatever its value. */
+  exists(path2) {
+    return `${assertPath(path2)}:exists`;
+  }
+};
+
+// ../../internal/core/authorization/tenantPermissions.ts
+var TenantPermissions = {
+  /** Rename the tenant and change its settings. */
+  SettingsManage: "tenants:settings:manage",
+  /** Invite an address to the tenant. */
+  MembersInvite: "tenants:members:invite",
+  /** Remove a member from the tenant. */
+  MembersRemove: "tenants:members:remove"
+};
+var SubtenantPermissions = {
+  /** Read any tenant below one you belong to. */
+  TreeRead: "subtenants:tree:read",
+  /** Rename a tenant below yours, and add or remove its members. */
+  TreeManage: "subtenants:tree:manage",
+  /** Create a tenant underneath one you belong to. */
+  TreeCreate: "subtenants:tree:create",
+  /**
+   * Make a tenant below yours the ACTIVE tenant of the session — acting inside
+   * it rather than on it from outside. Deliberately not the same permission as
+   * {@link SubtenantPermissions.TreeManage}: administering a sub-tenant through
+   * the management endpoints and operating as that sub-tenant are different
+   * powers, and granting the first should not hand over the second.
+   */
+  TreeSwitch: "subtenants:tree:switch"
+};
 export {
   AuthorizationError,
   AuthyonAbility,
@@ -1022,10 +1196,16 @@ export {
   AuthyonError,
   AuthyonServerClient,
   AuthyonServerClientBuilder,
+  CLIENT_IP_HEADER,
   ErrorCodes,
   FetchHttpAdapter,
   JwksTokenVerifier,
   LoggingHttpAdapter,
+  SubtenantPermissions,
+  TENANT_FILTER_MAX_DEPTH,
+  TENANT_FILTER_MAX_VALUES,
+  TENANT_FILTER_MAX_VALUE_LENGTH,
+  TenantPermissions,
   TenantScopedClient,
   TokenVerificationError,
   UserScopedClient,
@@ -1038,5 +1218,6 @@ export {
   createExpressAuthorizationMiddleware,
   hasPermission,
   hasPermissionGroup,
-  normalizeClientIp
+  normalizeClientIp,
+  tenantFilter
 };

package/dist/next.cjs

@@ -75,13 +75,23 @@ function createAuthyonRules(source = {}, options = {}) {
     ...source.permissions ?? [],
     ...source.scope?.split(/\s+/).filter(Boolean) ?? []
   ]);
-  const rules = [...permissions].map(permissionToRule).filter(isAbilityRule);
+  const rules = [...permissions].map(grantToRule).filter(isAbilityRule);
   for (const role of /* @__PURE__ */ new Set([...source.roles ?? [], ...options.roles ?? []])) {
     rules.push(...(options.roleRules?.[role] ?? []).map(cloneRule));
   }
   rules.push(...(options.rules ?? []).map(cloneRule));
   return rules;
 }
+function grantToRule(permission) {
+  const normalized = permission.trim();
+  if (normalized && isFullWildcard(normalized)) {
+    return { action: "manage", subject: "all" };
+  }
+  return permissionToRule(normalized);
+}
+function isFullWildcard(permission) {
+  return permission.split(":").every((segment) => segment === "*");
+}
 function permissionToRule(permission) {
   const normalized = permission.trim();
   if (!normalized) return null;

package/dist/next.d.cts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-DcA5oKZT.cjs';
-import { A as AuthyonServerClient } from './authyonServerClient-UA7HdjtD.cjs';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-BLENxur8.cjs';
+import { A as AuthyonServerClient } from './authyonServerClient-CW46xIRD.cjs';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/dist/next.d.ts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-DfFCoDQ6.js';
-import { A as AuthyonServerClient } from './authyonServerClient-UA7HdjtD.js';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-Clf0Jx-U.js';
+import { A as AuthyonServerClient } from './authyonServerClient-CW46xIRD.js';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/dist/next.js

@@ -2,7 +2,7 @@ import {
   AuthorizationError,
   authorizeRequest,
   authorizeToken
-} from "./chunk-NKWQMYB3.js";
+} from "./chunk-WF26WYSX.js";
 import "./chunk-77J4NURK.js";
 
 // src/next.ts

package/package.json

@@ -1,81 +1,81 @@
-{
-  "name": "@authyon/server",
-  "version": "0.2.0-beta.20",
-  "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
-  "license": "MIT",
-  "type": "module",
-  "engines": {
-    "node": ">=18"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Synkestra/package-authyon.git",
-    "directory": "packages/server"
-  },
-  "homepage": "https://authyon.com/docs",
-  "bugs": {
-    "url": "https://github.com/Synkestra/package-authyon/issues"
-  },
-  "main": "./dist/index.cjs",
-  "module": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "browser": "./dist/browser.js",
-      "import": "./dist/index.js",
-      "require": "./dist/index.cjs",
-      "default": "./dist/index.js"
-    },
-    "./bff": {
-      "types": "./dist/bff.d.ts",
-      "browser": "./dist/browser.js",
-      "import": "./dist/bff.js",
-      "require": "./dist/bff.cjs",
-      "default": "./dist/bff.js"
-    },
-    "./next": {
-      "types": "./dist/next.d.ts",
-      "import": "./dist/next.js",
-      "require": "./dist/next.cjs",
-      "default": "./dist/next.js"
-    }
-  },
-  "files": [
-    "dist"
-  ],
-  "sideEffects": false,
-  "publishConfig": {
-    "access": "public",
-    "provenance": true
-  },
-  "scripts": {
-    "build": "tsup src/index.ts src/browser.ts src/next.ts src/bff.ts --format esm,cjs --dts --clean",
-    "typecheck": "tsc --noEmit",
-    "prepack": "npm run build"
-  },
-  "keywords": [
-    "authyon",
-    "auth",
-    "server-to-server",
-    "management-api",
-    "tokenVerification"
-  ],
-  "dependencies": {
-    "jose": "^6.2.10"
-  },
-  "peerDependencies": {
-    "react": ">=18.2.0"
-  },
-  "peerDependenciesMeta": {
-    "react": {
-      "optional": true
-    }
-  },
-  "devDependencies": {
-    "@types/node": "^22.20.2",
-    "@types/react": "^19.2.18",
-    "tsup": "^8.0.0",
-    "typescript": "^5.5.0"
-  }
-}
+{
+  "name": "@authyon/server",
+  "version": "0.2.0-beta.22",
+  "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Synkestra/package-authyon.git",
+    "directory": "packages/server"
+  },
+  "homepage": "https://authyon.com/docs",
+  "bugs": {
+    "url": "https://github.com/Synkestra/package-authyon/issues"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "browser": "./dist/browser.js",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs",
+      "default": "./dist/index.js"
+    },
+    "./bff": {
+      "types": "./dist/bff.d.ts",
+      "browser": "./dist/browser.js",
+      "import": "./dist/bff.js",
+      "require": "./dist/bff.cjs",
+      "default": "./dist/bff.js"
+    },
+    "./next": {
+      "types": "./dist/next.d.ts",
+      "import": "./dist/next.js",
+      "require": "./dist/next.cjs",
+      "default": "./dist/next.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsup src/index.ts src/browser.ts src/next.ts src/bff.ts --format esm,cjs --dts --clean",
+    "typecheck": "tsc --noEmit",
+    "prepack": "npm run build"
+  },
+  "keywords": [
+    "authyon",
+    "auth",
+    "server-to-server",
+    "management-api",
+    "tokenVerification"
+  ],
+  "dependencies": {
+    "jose": "^6.2.10"
+  },
+  "peerDependencies": {
+    "react": ">=18.2.0"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.2",
+    "@types/react": "^19.2.18",
+    "tsup": "^8.0.0",
+    "typescript": "^5.5.0"
+  }
+}