@canopy-io/node 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @canopy-io/node
 
+## 0.12.0
+
+### Minor Changes
+
+- 10d3583: Organization membership is admission, not a role. Identity tokens carry `org_roles` (the names of the roles held at the organization node, sorted, possibly empty) in place of `org_role`; `orgContext(claims)` returns `{ orgId, orgRoles }`, and refuses a token carrying one claim without the other. An empty `orgRoles` is a member holding no role at the organization node, so authorize by evaluating rather than by the list. The conformance bundle gains the `organization-membership` vector: a grant inside an organization counts only while the membership is active, which the grants `LocalAuthorizer` caches already reflect.
+  
+  `organizations.changeMemberRole()` is gone with its route: a member's role at the organization is an assignment at the organization node, written through `assignments.create()`, `assignments.update()` and `assignments.delete()` with the organization node as `node_id`. `assignments.update()` takes `{ ifMatch }` and sends it as `If-Match`; a stale version answers `409 assignment.version_mismatch`. `organizations.removeMember()` deactivates the membership and revokes every role the member held in the organization. Member rows carry `status`, `source`, `joined_at` and `roles[]` in place of the single `role`.
+
 ## 0.11.0
 
 ### Minor Changes

package/README.md

@@ -143,8 +143,10 @@ throws with neither. Getting it wrong fails closed: tokens are rejected, never
 mistakenly accepted.
 
 With an Environment's **organizations** container on, an identity token also
-names the organization the session is acting in and the one role held there. Read the pair through `orgContext` rather than off the raw claims —
-Canopy mints the two together, and the helper refuses a half-present pair:
+names the organization the session is acting in and the roles held at that
+organization's node. Read the pair through `orgContext` rather than off the raw
+claims — Canopy mints the two together, and the helper refuses a half-present
+pair:
 
 ```ts
 import { orgContext } from "@canopy-io/node";
@@ -153,12 +155,20 @@ const org = orgContext(claims);
 
 if (org) {
   org.orgId; // the organization — also a hierarchy node id
-  org.orgRole; // the single role held there, by name
+  org.orgRoles; // the roles held at its node, by name; [] for a member holding none there
 }
 ```
 
 `null` is an ordinary answer: every token from an Environment without the
-container on, and every identity that belongs to no organization yet.
+container on, and every identity that belongs to no organization yet. An empty
+`orgRoles` is not: membership is admission, and a member may hold roles only
+beneath the organization. Authorize by evaluating, never by the list.
+
+A grant inside an organization counts only while the membership is active.
+The grants `LocalAuthorizer` caches already apply that: a deactivated
+membership drops every grant inside the organization from the next read, so
+the authorizer sees it within the cache TTL, and sooner on
+`invalidate(identityId)` when an `organization.member.removed` webhook arrives.
 
 Tokens also carry `amr`, how the session was proven (`pwd`, `otp` or `sso`,
 plus `mfa` once a second factor was verified), so a backend can insist on

package/dist/index.cjs

@@ -473,6 +473,14 @@ function paginate(fetchPage, initial = {}, options = {}) {
   return new Paginator(fetchPage, initial, options);
 }
 
+// src/schema.ts
+function withConcurrency(options = {}) {
+  if (options.ifMatch === void 0) {
+    return {};
+  }
+  return { headers: { "If-Match": options.ifMatch } };
+}
+
 // src/resources/assignments.ts
 var Assignments = class {
   constructor(client) {
@@ -498,11 +506,16 @@ var Assignments = class {
   create(input) {
     return this.client.request("POST", "/api/v1/assignments", { body: input });
   }
-  update(id, input) {
+  /**
+   * Change the role or the window of a grant. Pass the `version` the
+   * assignment was read with as `ifMatch`; a stale one answers 409
+   * `assignment.version_mismatch` rather than overwriting a newer change.
+   */
+  update(id, input, options = {}) {
     return this.client.request(
       "PATCH",
       `/api/v1/assignments/${encodeURIComponent(id)}`,
-      { body: input }
+      { body: input, ...withConcurrency(options) }
     );
   }
   delete(id) {
@@ -677,14 +690,6 @@ var Identities = class {
   }
 };
 
-// src/schema.ts
-function withConcurrency(options = {}) {
-  if (options.ifMatch === void 0) {
-    return {};
-  }
-  return { headers: { "If-Match": options.ifMatch } };
-}
-
 // src/resources/organizations.ts
 var Organizations = class {
   constructor(client) {
@@ -734,7 +739,7 @@ var Organizations = class {
   deleteAll() {
     return this.client.request("DELETE", "/api/v1/organizations");
   }
-  // ── Members: one role per member, held inside the organization only ──
+  // ── Members: admission to the organization, apart from the roles held in it ──
   listMembers(id, query = {}) {
     return paginate(
       (params) => this.client.request("GET", `/api/v1/organizations/${enc(id)}/members`, {
@@ -750,14 +755,12 @@ var Organizations = class {
       { body: input }
     );
   }
-  changeMemberRole(id, identityId, input) {
-    return this.client.request(
-      "PATCH",
-      `/api/v1/organizations/${enc(id)}/members/${enc(identityId)}`,
-      { body: input }
-    );
-  }
-  /** Revokes that organization's one role; the identity and its other memberships are untouched. */
+  /**
+   * Deactivates the membership and revokes every role the member holds at
+   * the organization's nodes; the identity and its other memberships are
+   * untouched. A role in the organization is changed through the
+   * organization's assignment routes, not here.
+   */
   removeMember(id, identityId) {
     return this.client.request(
       "DELETE",
@@ -1771,11 +1774,11 @@ function resolveIssuer(options) {
   );
 }
 function orgContext(claims) {
-  const { org_id, org_role } = claims;
-  if (typeof org_id !== "string" || org_id === "" || typeof org_role !== "string" || org_role === "") {
+  const { org_id, org_roles } = claims;
+  if (typeof org_id !== "string" || org_id === "" || !Array.isArray(org_roles) || org_roles.some((role) => typeof role !== "string" || role === "")) {
     return null;
   }
-  return { orgId: org_id, orgRole: org_role };
+  return { orgId: org_id, orgRoles: [...org_roles] };
 }
 function decodeBase64Url(value) {
   const padded = value.replace(/-/g, "+").replace(/_/g, "/");