@bajustone/fortress 1.0.0-rc.1

package/dist/plugins/tenancy.js

@@ -0,0 +1,753 @@
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/core/schema-builder.ts
+import { fromJSONSchema } from "@bajustone/fetcher/openapi";
+import { date as fDate, datetime as fDatetime, email as fEmail, time as fTime, url as fUrl, uuid as fUuid } from "@bajustone/fetcher/schema";
+function collectRefNames(schema, acc) {
+  if (!schema || typeof schema !== "object")
+    return acc;
+  if (typeof schema.$ref === "string") {
+    const i = schema.$ref.lastIndexOf("/");
+    acc.add(i >= 0 ? schema.$ref.slice(i + 1) : schema.$ref);
+  }
+  if (schema.properties) {
+    for (const key of Object.keys(schema.properties))
+      collectRefNames(schema.properties[key], acc);
+  }
+  collectRefNames(schema.items, acc);
+  for (const key of ["oneOf", "anyOf", "allOf"]) {
+    const variants = schema[key];
+    if (variants) {
+      for (const variant of variants)
+        collectRefNames(variant, acc);
+    }
+  }
+  if (schema.additionalProperties && typeof schema.additionalProperties === "object")
+    collectRefNames(schema.additionalProperties, acc);
+  return acc;
+}
+var refDefinitionContexts = /* @__PURE__ */ new WeakMap();
+function refName(refPath) {
+  const i = refPath.lastIndexOf("/");
+  return i >= 0 ? refPath.slice(i + 1) : refPath;
+}
+var COMPONENT_NAME_RE = /^[\w.-]+$/;
+function assertComponentName(name) {
+  if (!COMPONENT_NAME_RE.test(name))
+    throw new Error(`Invalid OpenAPI component name '${name}'`);
+}
+function resolveRefDefs(schema) {
+  if (collectRefNames(schema, /* @__PURE__ */ new Set()).size === 0)
+    return void 0;
+  const defs = /* @__PURE__ */ Object.create(null);
+  const unresolved = /* @__PURE__ */ new Set();
+  const hasOwn = (value, key) => Object.hasOwn(value, key);
+  const visit = (node, inherited) => {
+    if (!node || typeof node !== "object")
+      return;
+    const context = refDefinitionContexts.get(node) ?? inherited;
+    if (typeof node.$ref === "string") {
+      const name = refName(node.$ref);
+      const component = context && hasOwn(context, name) ? context[name] : void 0;
+      if (component) {
+        if (hasOwn(defs, name) && !unresolved.has(name) && defs[name] !== component) {
+          throw new Error(`Conflicting component definitions for $ref '${name}'`);
+        }
+        const firstResolution = !hasOwn(defs, name) || unresolved.delete(name);
+        defs[name] = component;
+        if (firstResolution)
+          visit(component, context);
+      } else if (!hasOwn(defs, name)) {
+        defs[name] = {};
+        unresolved.add(name);
+      }
+    }
+    if (node.properties) {
+      for (const child of Object.values(node.properties))
+        visit(child, context);
+    }
+    visit(node.items, context);
+    for (const key of ["oneOf", "anyOf", "allOf"]) {
+      for (const child of node[key] ?? [])
+        visit(child, context);
+    }
+    if (node.additionalProperties && typeof node.additionalProperties === "object")
+      visit(node.additionalProperties, context);
+  };
+  visit(schema);
+  return defs;
+}
+function createStandardProps(schema) {
+  let validateFn;
+  return {
+    version: 1,
+    vendor: "fortress",
+    validate(value) {
+      if (!validateFn) {
+        const defs = resolveRefDefs(schema);
+        validateFn = fromJSONSchema(schema, defs)["~standard"].validate;
+      }
+      return validateFn(value);
+    }
+  };
+}
+function toFortressSchema(schema, refDefinitions, standardProps) {
+  if (refDefinitions)
+    refDefinitionContexts.set(schema, refDefinitions);
+  return Object.assign(schema, {
+    "~standard": standardProps ?? createStandardProps(schema)
+  });
+}
+function str(opts) {
+  const o = typeof opts === "string" ? { description: opts } : opts ?? {};
+  const s = { type: "string" };
+  if (o.description)
+    s.description = o.description;
+  if (o.min !== void 0)
+    s.minLength = o.min;
+  if (o.max !== void 0)
+    s.maxLength = o.max;
+  if (o.pattern !== void 0)
+    s.pattern = o.pattern;
+  if (o.format !== void 0)
+    s.format = o.format;
+  return toFortressSchema(s);
+}
+function int(opts) {
+  const o = typeof opts === "string" ? { description: opts } : opts ?? {};
+  const s = { type: "integer" };
+  if (o.description)
+    s.description = o.description;
+  if (o.min !== void 0)
+    s.minimum = o.min;
+  if (o.max !== void 0)
+    s.maximum = o.max;
+  return toFortressSchema(s);
+}
+function id(description) {
+  const s = { type: "string", minLength: 1 };
+  if (description)
+    s.description = description;
+  return toFortressSchema(s);
+}
+function bool(description) {
+  const s = { type: "boolean" };
+  if (description)
+    s.description = description;
+  return toFortressSchema(s);
+}
+function arr(items, description) {
+  const s = { type: "array", items };
+  if (description)
+    s.description = description;
+  return toFortressSchema(s);
+}
+function obj(properties, ...required) {
+  const s = { type: "object", properties };
+  if (required.length > 0)
+    s.required = required;
+  return toFortressSchema(s);
+}
+function ref(name, schema) {
+  assertComponentName(name);
+  const definitions = schema ? { [name]: schema } : void 0;
+  return toFortressSchema({ $ref: `#/components/schemas/${name}` }, definitions);
+}
+function makeFormatBuilder(factory) {
+  const f = factory();
+  return (description) => {
+    const s = { type: "string" };
+    if (f.format)
+      s.format = f.format;
+    if (f.pattern)
+      s.pattern = f.pattern;
+    if (description)
+      s.description = description;
+    return toFortressSchema(s);
+  };
+}
+var email = makeFormatBuilder(fEmail);
+var uuid = makeFormatBuilder(fUuid);
+var url = makeFormatBuilder(fUrl);
+var datetime = makeFormatBuilder(fDatetime);
+var date = makeFormatBuilder(fDate);
+var time = makeFormatBuilder(fTime);
+function isStandardSchema(value) {
+  return typeof value === "object" && value !== null && "~standard" in value && typeof value["~standard"]?.validate === "function";
+}
+function isFortressSchema(value) {
+  return isStandardSchema(value) && value["~standard"].vendor === "fortress" && ("type" in value || "$ref" in value || "oneOf" in value || "anyOf" in value);
+}
+var JSON_SCHEMA_TYPES = /* @__PURE__ */ new Set(["string", "number", "integer", "boolean", "object", "array", "null"]);
+function hasJsonSchemaShape(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const v = value;
+  if ("$ref" in v || "oneOf" in v || "anyOf" in v || "allOf" in v)
+    return true;
+  if (typeof v.type === "string" && JSON_SCHEMA_TYPES.has(v.type))
+    return true;
+  if (Array.isArray(v.type) && v.type.every((t) => typeof t === "string" && JSON_SCHEMA_TYPES.has(t)))
+    return true;
+  return false;
+}
+function extractJsonSchema(schema) {
+  if (isFortressSchema(schema)) {
+    return schema;
+  }
+  if (isStandardSchema(schema)) {
+    const std = schema["~standard"];
+    if (std?.jsonSchema?.input) {
+      return std.jsonSchema.input({ target: "draft-2020-12" });
+    }
+    if (hasJsonSchemaShape(schema)) {
+      return schema;
+    }
+  }
+  return {};
+}
+var ErrorEnvelope = obj({
+  code: str("Machine-readable error code"),
+  message: str("Human-readable error message"),
+  statusCode: int("HTTP status code"),
+  details: toFortressSchema({ description: "Optional structured error details" })
+}, "code", "message", "statusCode");
+var EndpointBuilder = class {
+  _method;
+  _path;
+  _handler = "";
+  _summary = "";
+  _description;
+  _tags = [];
+  _security = [];
+  _deprecated = false;
+  _permission;
+  _body;
+  _query;
+  _params;
+  _responses = {};
+  constructor(method, path) {
+    this._method = method;
+    this._path = path;
+  }
+  summary(s) {
+    this._summary = s;
+    return this;
+  }
+  description(s) {
+    this._description = s;
+    return this;
+  }
+  tags(...t) {
+    this._tags.push(...t);
+    return this;
+  }
+  security(...s) {
+    this._security.push(...s);
+    return this;
+  }
+  deprecated() {
+    this._deprecated = true;
+    return this;
+  }
+  permission(resource, action) {
+    this._permission = { resource, action };
+    return this;
+  }
+  body(schema) {
+    this._body = schema;
+    return this;
+  }
+  query(schema) {
+    this._query = schema;
+    return this;
+  }
+  params(schema) {
+    this._params = schema;
+    return this;
+  }
+  response(status, description, schema) {
+    const stored = { description };
+    if (schema !== void 0) {
+      stored.schema = isStandardSchema(schema) ? extractJsonSchema(schema) : schema;
+    }
+    this._responses[status] = stored;
+    return this;
+  }
+  /**
+   * Declare an error response that returns the canonical {@link ErrorEnvelope}
+   * body. Shorthand for `.response(status, description, ErrorEnvelope)`.
+   *
+   * Aligns host endpoint error responses with what Fortress's own routes
+   * emit, so a single client-side error parser works everywhere.
+   *
+   * ```ts
+   * endpoint('GET', '/schools/:id')
+   *   .summary('Get a school')
+   *   .params(obj({ id: str() }, 'id'))
+   *   .response(200, 'OK', SchoolEnvelope)
+   *   .errorResponse(404, 'School not found')
+   *   .errorResponse(403, 'Forbidden')
+   *   .build();
+   * ```
+   */
+  errorResponse(status, description) {
+    return this.response(status, description, ErrorEnvelope);
+  }
+  handler(name) {
+    this._handler = name;
+    return this;
+  }
+  build() {
+    const def = {
+      method: this._method,
+      path: this._path,
+      handler: this._handler
+    };
+    if (this._summary || this._tags.length > 0 || this._security.length > 0 || this._description || this._deprecated || this._permission) {
+      def.meta = {
+        summary: this._summary,
+        ...this._description && { description: this._description },
+        ...this._tags.length > 0 && { tags: this._tags },
+        ...this._security.length > 0 && { security: this._security },
+        ...this._deprecated && { deprecated: true },
+        ...this._permission && { permission: this._permission }
+      };
+    }
+    if (this._body || this._query || this._params) {
+      def.input = {};
+      if (this._body) {
+        def.input.body = extractJsonSchema(this._body);
+        if (isStandardSchema(this._body))
+          def.input.bodySchema = this._body;
+      }
+      if (this._query) {
+        def.input.query = extractJsonSchema(this._query);
+        if (isStandardSchema(this._query))
+          def.input.querySchema = this._query;
+      }
+      if (this._params) {
+        def.input.params = extractJsonSchema(this._params);
+        if (isStandardSchema(this._params))
+          def.input.paramsSchema = this._params;
+      }
+    }
+    if (Object.keys(this._responses).length > 0) {
+      def.responses = this._responses;
+    }
+    return def;
+  }
+};
+function endpoint(method, path) {
+  return new EndpointBuilder(method, path);
+}
+
+// src/plugins/tenancy/index.ts
+var SAFE_SCHEMA_PREFIX = /^[a-z_][a-z0-9_]*$/;
+var SAFE_TENANT_ID = /^[\w-]+$/;
+function assertSafeSchemaPrefix(prefix) {
+  if (!SAFE_SCHEMA_PREFIX.test(prefix))
+    throw Errors.badRequest(`Invalid tenancy schemaPrefix '${prefix}': must match ${SAFE_SCHEMA_PREFIX}`);
+}
+var errorRef = ref("ErrorResponse");
+var tenantResponse = obj({
+  id: id("Tenant id"),
+  name: str("Tenant name"),
+  taxId: str("Unique tenant tax id / external code"),
+  description: str("Optional description"),
+  createdAt: str("ISO 8601 creation timestamp"),
+  updatedAt: str("ISO 8601 update timestamp")
+}, "id", "name", "taxId");
+var tenancyRoutes = {
+  createTenant: endpoint("POST", "/tenancy/tenants").summary("Create a tenant").description("Create a new tenant and its PostgreSQL schema. Requires the `fortress:manageTenants` permission.").tags("Tenancy").security("bearer").permission("fortress", "manageTenants").body(obj({
+    name: str("Human-readable tenant name"),
+    taxId: str("Unique tenant tax id / external code"),
+    description: str("Optional description")
+  }, "name", "taxId")).response(201, "Tenant created", tenantResponse).response(401, "Not authenticated", errorRef).response(403, "Insufficient permissions", errorRef).response(409, "taxId already exists", errorRef).handler("createTenant").build(),
+  deleteTenant: endpoint("DELETE", "/tenancy/tenants/:id").summary("Delete a tenant").description("Remove a tenant, its memberships, and (when `dropSchemaOnDelete` is enabled) its schema. Requires the `fortress:manageTenants` permission.").tags("Tenancy").security("bearer").permission("fortress", "manageTenants").params(obj({ id: str("Tenant id") }, "id")).response(200, "Tenant deleted", obj({ ok: bool("Always true") }, "ok")).response(401, "Not authenticated", errorRef).response(403, "Insufficient permissions", errorRef).response(404, "Tenant not found", errorRef).handler("deleteTenant").build(),
+  getMyTenants: endpoint("GET", "/tenancy/tenants/mine").summary("List the caller's tenants").description("Return the tenants the authenticated caller belongs to.").tags("Tenancy").security("bearer").response(200, "Tenants", obj({ tenants: arr(tenantResponse, "Tenants the caller belongs to") }, "tenants")).response(401, "Not authenticated", errorRef).handler("getMyTenants").build(),
+  switchTenant: endpoint("POST", "/tenancy/switch").summary("Switch the caller's default tenant").description("Set the authenticated caller's default tenant. The new tenant takes effect on the next token refresh.").tags("Tenancy").security("bearer").body(obj({ taxId: str("Tax id of the tenant to switch to") }, "taxId")).response(200, "Switched", obj({ ok: bool("Always true") }, "ok")).response(401, "Not authenticated", errorRef).response(403, "Caller does not belong to this tenant", errorRef).response(404, "Tenant not found", errorRef).handler("switchTenant").build()
+};
+function tenancy(config = {}) {
+  const schemaPrefix = config.schemaPrefix ?? "tenant_";
+  assertSafeSchemaPrefix(schemaPrefix);
+  const mountRoutes = config.routes === true;
+  const tenantSchemaName = (id2) => `${schemaPrefix}${id2}`;
+  return {
+    name: "tenancy",
+    models: [
+      {
+        name: "tenant",
+        fields: {
+          id: { type: "number", required: true },
+          name: { type: "string", required: true },
+          taxId: { type: "string", required: true, unique: true },
+          description: { type: "string" },
+          createdAt: { type: "date", required: true },
+          updatedAt: { type: "date", required: true }
+        }
+      },
+      {
+        name: "tenant_user",
+        fields: {
+          tenantId: { type: "number", required: true, references: { model: "tenant", field: "id" } },
+          userId: { type: "number", required: true, references: { model: "user", field: "id" } },
+          isDefault: { type: "boolean", required: true }
+        }
+      }
+    ],
+    ...mountRoutes ? { routes: tenancyRoutes } : {},
+    async enrichTokenClaims(userId, ctx) {
+      const membership = await ctx.db.findOne({
+        model: "tenant_user",
+        where: [
+          { field: "userId", operator: "=", value: userId },
+          { field: "isDefault", operator: "=", value: true }
+        ]
+      });
+      if (!membership)
+        return {};
+      const tenant = await ctx.db.findOne({
+        model: "tenant",
+        where: [{ field: "id", operator: "=", value: membership.tenantId }]
+      });
+      if (!tenant)
+        return {};
+      return {
+        tenantId: tenant.id,
+        tenantCode: tenant.taxId
+      };
+    },
+    wrapAdapter(adapter, requestContext) {
+      const tenantId = requestContext.tenantId;
+      if (tenantId == null)
+        return adapter;
+      if (!SAFE_TENANT_ID.test(tenantId))
+        throw Errors.forbidden("Invalid tenant claim");
+      const isPg = adapter.dialect === "pg" && !!adapter.rawQuery;
+      if (!isPg)
+        return adapter;
+      const schemaName = tenantSchemaName(tenantId);
+      const setPath = (tx) => tx.rawQuery(`SELECT set_config('search_path', ?, true)`, [`${schemaName}, public`]);
+      return {
+        ...adapter,
+        async create(params) {
+          return adapter.transaction(async (tx) => {
+            await setPath(tx);
+            return tx.create(params);
+          });
+        },
+        async findOne(params) {
+          return adapter.transaction(async (tx) => {
+            await setPath(tx);
+            return tx.findOne(params);
+          });
+        },
+        async findMany(params) {
+          return adapter.transaction(async (tx) => {
+            await setPath(tx);
+            return tx.findMany(params);
+          });
+        },
+        async update(params) {
+          return adapter.transaction(async (tx) => {
+            await setPath(tx);
+            return tx.update(params);
+          });
+        },
+        async delete(params) {
+          return adapter.transaction(async (tx) => {
+            await setPath(tx);
+            return tx.delete(params);
+          });
+        },
+        async count(params) {
+          return adapter.transaction(async (tx) => {
+            await setPath(tx);
+            return tx.count(params);
+          });
+        },
+        async transaction(fn) {
+          return adapter.transaction(async (tx) => {
+            await setPath(tx);
+            return fn(tx);
+          });
+        }
+      };
+    },
+    methods: (ctx) => {
+      const findTenantByTaxId = (taxId) => ctx.db.findOne({
+        model: "tenant",
+        where: [{ field: "taxId", operator: "=", value: taxId }]
+      });
+      const listUserTenants = async (userId) => {
+        const memberships = await ctx.db.findMany({
+          model: "tenant_user",
+          where: [{ field: "userId", operator: "=", value: userId }]
+        });
+        if (memberships.length === 0)
+          return [];
+        const tenantIds = memberships.map((m) => m.tenantId);
+        return ctx.db.findMany({
+          model: "tenant",
+          where: [{ field: "id", operator: "in", value: tenantIds }]
+        });
+      };
+      const requireUserId = (input, routeCtx) => {
+        const userId = routeCtx?.userId ?? input.userId;
+        if (userId == null) {
+          if (routeCtx)
+            throw Errors.unauthorized("Not authenticated");
+          throw Errors.badRequest("userId is required for programmatic calls");
+        }
+        return userId;
+      };
+      const defaultTenantQueues = /* @__PURE__ */ new Map();
+      const withDefaultTenantLock = async (userId, operation) => {
+        const previous = defaultTenantQueues.get(userId) ?? Promise.resolve();
+        let release;
+        const current = new Promise((resolve) => {
+          release = resolve;
+        });
+        defaultTenantQueues.set(userId, current);
+        await previous;
+        try {
+          return await ctx.db.transaction(async (tx) => {
+            if (tx.dialect === "pg" && tx.rawQuery) {
+              await tx.rawQuery("SELECT pg_advisory_xact_lock(hashtext(?))", [`fortress:tenant-default:${userId}`]);
+            }
+            return operation(tx);
+          });
+        } finally {
+          release();
+          if (defaultTenantQueues.get(userId) === current)
+            defaultTenantQueues.delete(userId);
+        }
+      };
+      return {
+        async createTenant(input) {
+          const existing = await findTenantByTaxId(input.taxId);
+          if (existing)
+            throw Errors.conflict(`Tenant with taxId '${input.taxId}' already exists`);
+          return ctx.db.transaction(async (tx) => {
+            const tenant = await tx.create({
+              model: "tenant",
+              data: {
+                name: input.name,
+                taxId: input.taxId,
+                description: input.description ?? null
+              }
+            });
+            if (tx.dialect === "pg" && tx.rawQuery) {
+              const schemaName = tenantSchemaName(tenant.id);
+              await tx.rawQuery(`CREATE SCHEMA IF NOT EXISTS ${schemaName}`);
+              if (config.onSchemaCreated)
+                await config.onSchemaCreated(schemaName, tx.rawQuery.bind(tx));
+            }
+            return tenant;
+          });
+        },
+        async deleteTenant(input) {
+          const id2 = String(input.id ?? "");
+          if (!id2)
+            throw Errors.badRequest("id is required");
+          const tenant = await ctx.db.findOne({
+            model: "tenant",
+            where: [{ field: "id", operator: "=", value: id2 }]
+          });
+          if (!tenant)
+            throw Errors.notFound(`Tenant '${id2}' not found`);
+          await ctx.db.transaction(async (tx) => {
+            await tx.delete({
+              model: "tenant_user",
+              where: [{ field: "tenantId", operator: "=", value: id2 }]
+            });
+            await tx.delete({
+              model: "tenant",
+              where: [{ field: "id", operator: "=", value: id2 }]
+            });
+            if (config.dropSchemaOnDelete && tx.dialect === "pg" && tx.rawQuery) {
+              const schemaName = tenantSchemaName(id2);
+              await tx.rawQuery(`DROP SCHEMA IF EXISTS ${schemaName} CASCADE`);
+            }
+          });
+          return { ok: true };
+        },
+        async addUserToTenant(userId, tenantId) {
+          await withDefaultTenantLock(userId, async (tx) => {
+            const existing = await tx.findOne({
+              model: "tenant_user",
+              where: [
+                { field: "userId", operator: "=", value: userId },
+                { field: "tenantId", operator: "=", value: tenantId }
+              ]
+            });
+            if (existing)
+              return;
+            const memberships = await tx.findMany({
+              model: "tenant_user",
+              where: [{ field: "userId", operator: "=", value: userId }]
+            });
+            await tx.create({
+              model: "tenant_user",
+              data: {
+                tenantId,
+                userId,
+                isDefault: memberships.length === 0
+              }
+            });
+          });
+        },
+        async getUserTenants(userId) {
+          return listUserTenants(userId);
+        },
+        async getMyTenants(input, routeCtx) {
+          return { tenants: await listUserTenants(requireUserId(input, routeCtx)) };
+        },
+        async switchTenant(input, routeCtx) {
+          const userId = requireUserId(input, routeCtx);
+          const tenant = await findTenantByTaxId(input.taxId);
+          if (!tenant)
+            throw Errors.notFound(`Tenant '${input.taxId}' not found`);
+          await withDefaultTenantLock(userId, async (tx) => {
+            const membership = await tx.findOne({
+              model: "tenant_user",
+              where: [
+                { field: "userId", operator: "=", value: userId },
+                { field: "tenantId", operator: "=", value: tenant.id }
+              ]
+            });
+            if (!membership)
+              throw Errors.forbidden("User does not belong to this tenant");
+            await tx.update({
+              model: "tenant_user",
+              where: [
+                { field: "userId", operator: "=", value: userId },
+                { field: "isDefault", operator: "=", value: true }
+              ],
+              data: { isDefault: false }
+            });
+            await tx.update({
+              model: "tenant_user",
+              where: [
+                { field: "userId", operator: "=", value: userId },
+                { field: "tenantId", operator: "=", value: tenant.id }
+              ],
+              data: { isDefault: true }
+            });
+          });
+          return { ok: true };
+        }
+      };
+    }
+  };
+}
+export {
+  tenancy
+};