@brightweblabs/module-orgs 0.3.1 → 0.3.3

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@brightweblabs/module-orgs",
   "private": false,
-  "version": "0.3.1",
+  "version": "0.3.3",
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "files": [
@@ -23,8 +23,8 @@
   "dependencies": {
     "@supabase/supabase-js": "^2.110.8",
     "server-only": "^0.0.1",
-    "@brightweblabs/core-auth": "0.5.0",
-    "@brightweblabs/app-shell": "0.6.0",
-    "@brightweblabs/infra": "0.3.2"
+    "@brightweblabs/app-shell": "0.6.1",
+    "@brightweblabs/core-auth": "0.6.0",
+    "@brightweblabs/infra": "0.3.3"
   }
 }

package/src/access.ts

@@ -16,8 +16,20 @@ type OrganizationAccessError = {
   error: string;
 };
 
-async function resolveBaseOrganizationAccess(): Promise<OrganizationBaseAccess | OrganizationAccessError> {
-  const access = await requireServerUserAccess();
+export type OrganizationAccessDependencies = {
+  getAccess: typeof requireServerUserAccess;
+  getServiceClient: typeof requireServiceRoleClient;
+};
+
+const defaultOrganizationAccessDependencies: OrganizationAccessDependencies = {
+  getAccess: requireServerUserAccess,
+  getServiceClient: requireServiceRoleClient,
+};
+
+async function resolveBaseOrganizationAccess(
+  dependencies: OrganizationAccessDependencies,
+): Promise<OrganizationBaseAccess | OrganizationAccessError> {
+  const access = await dependencies.getAccess();
   if (!access.ok) {
     return access.status === 409
       ? { ok: false, status: 403, error: "Perfil não encontrado." }
@@ -26,7 +38,7 @@ async function resolveBaseOrganizationAccess(): Promise<OrganizationBaseAccess |
   if (!access.role) return { ok: false, status: 403, error: "Acesso proibido." };
 
   return {
-    serviceSupabase: requireServiceRoleClient(),
+    serviceSupabase: dependencies.getServiceClient(),
     user: access.user,
     role: access.role,
     profileId: access.profileId,
@@ -39,29 +51,45 @@ function isAccessError(
   return "ok" in access && access.ok === false;
 }
 
-export async function requireOrganizationsStaffAccess() {
-  const base = await resolveBaseOrganizationAccess();
-  if (isAccessError(base)) return base;
-  if (base.role !== "admin" && base.role !== "staff") {
-    return { ok: false, status: 403, error: "Acesso proibido." } as const;
-  }
-  return { ok: true, ...base } as const;
+export function createOrganizationsStaffAccessGuard(
+  dependencies: OrganizationAccessDependencies,
+) {
+  return async function organizationsStaffAccess() {
+    const base = await resolveBaseOrganizationAccess(dependencies);
+    if (isAccessError(base)) return base;
+    if (base.role !== "admin" && base.role !== "staff") {
+      return { ok: false, status: 403, error: "Acesso proibido." } as const;
+    }
+    return { ok: true, ...base } as const;
+  };
 }
 
-export async function requireOrganizationManageAccess(organizationId: string) {
-  const base = await resolveBaseOrganizationAccess();
-  if (isAccessError(base)) return base;
-  if (base.role === "admin" || base.role === "staff") {
+export function createOrganizationManageAccessGuard(
+  dependencies: OrganizationAccessDependencies,
+) {
+  return async function organizationManageAccess(organizationId: string) {
+    const base = await resolveBaseOrganizationAccess(dependencies);
+    if (isAccessError(base)) return base;
+    if (base.role === "admin" || base.role === "staff") {
+      return { ok: true, ...base, isOrgMember: true, isOrgAdmin: true } as const;
+    }
+
+    const { data, error } = await base.serviceSupabase
+      .from("organization_members")
+      .select("role")
+      .eq("organization_id", organizationId)
+      .eq("profile_id", base.profileId)
+      .maybeSingle<{ role: string }>();
+    if (error) return { ok: false, status: 500, error: error.message } as const;
+    if (data?.role !== "admin") return { ok: false, status: 403, error: "Acesso proibido." } as const;
     return { ok: true, ...base, isOrgMember: true, isOrgAdmin: true } as const;
-  }
+  };
+}
 
-  const { data, error } = await base.serviceSupabase
-    .from("organization_members")
-    .select("role")
-    .eq("organization_id", organizationId)
-    .eq("profile_id", base.profileId)
-    .maybeSingle<{ role: string }>();
-  if (error) return { ok: false, status: 500, error: error.message } as const;
-  if (data?.role !== "admin") return { ok: false, status: 403, error: "Acesso proibido." } as const;
-  return { ok: true, ...base, isOrgMember: true, isOrgAdmin: true } as const;
+export async function requireOrganizationsStaffAccess() {
+  return createOrganizationsStaffAccessGuard(defaultOrganizationAccessDependencies)();
+}
+
+export async function requireOrganizationManageAccess(organizationId: string) {
+  return createOrganizationManageAccessGuard(defaultOrganizationAccessDependencies)(organizationId);
 }