@cedarjs/router 8.0.0-canary.3541 → 8.0.0-canary.3545

package/dist/AuthenticatedRoute.d.ts

@@ -1,9 +1,12 @@
 import React from 'react';
-import type { GeneratedRoutesMap } from './analyzeRoutes.js';
 interface AuthenticatedRouteProps {
-    children: React.ReactNode | Thenable<React.ReactNode>;
+    children: React.ReactNode;
     roles?: string | string[];
-    unauthenticated: keyof GeneratedRoutesMap;
+    userRoles?: string | string[];
+    orgRoles?: string | string[];
+    orgPermission?: string;
+    unauthenticated: string;
+    unauthorized?: string;
     whileLoadingAuth?: () => React.ReactElement | null;
 }
 export declare const AuthenticatedRoute: React.FC<AuthenticatedRouteProps>;

package/dist/AuthenticatedRoute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticatedRoute.d.ts","sourceRoot":"","sources":["../src/AuthenticatedRoute.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAsB,MAAM,OAAO,CAAA;AAE1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAK5D,UAAU,uBAAuB;IAC/B,QAAQ,EAAE,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACrD,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,eAAe,EAAE,MAAM,kBAAkB,CAAA;IACzC,gBAAgB,CAAC,EAAE,MAAM,KAAK,CAAC,YAAY,GAAG,IAAI,CAAA;CACnD;AAED,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CA6DhE,CAAA"}
+{"version":3,"file":"AuthenticatedRoute.d.ts","sourceRoot":"","sources":["../src/AuthenticatedRoute.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAoC,MAAM,OAAO,CAAA;AAQxD,UAAU,uBAAuB;IAC/B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,MAAM,KAAK,CAAC,YAAY,GAAG,IAAI,CAAA;CACnD;AAgFD,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAkJhE,CAAA"}

package/dist/AuthenticatedRoute.js

@@ -1,48 +1,137 @@
-import React, { useCallback } from "react";
-import { namedRoutes } from "./namedRoutes.js";
+import React, { createContext, useContext } from "react";
+import { useLocation } from "./location.js";
 import { Redirect } from "./redirect.js";
 import { useRouterState } from "./router-context.js";
+import { paramsForRoute, pathParamsText } from "./util.js";
+const REPLACE = { replace: true };
+const useNoOrg = () => null;
+const MountedOrgContext = createContext(void 0);
+const toList = (roles) => Array.isArray(roles) ? roles : [roles];
+function currentPathParams(routerState, pathname) {
+  const route = Object.values(routerState.routes.pathRouteMap).find(
+    (candidate) => candidate.name === routerState.activeRouteName
+  );
+  if (!route?.path) {
+    return {};
+  }
+  return pathParamsText(route.path, pathname, routerState.paramTypes);
+}
+function redirectPath(routes, name, params) {
+  if (!Object.hasOwn(routes.namedRoutesMap, name)) {
+    throw new Error(`We could not find a route named ${name}`);
+  }
+  const route = Object.values(routes.pathRouteMap).find(
+    (candidate) => candidate.name === name
+  );
+  if (!route) {
+    return routes.namedRoutesMap[name]();
+  }
+  const routeParams = {};
+  for (const [paramName] of paramsForRoute(route.path)) {
+    const value = params[paramName];
+    if (value === void 0) {
+      throw new Error(
+        `Redirecting to route "${name}" requires the route parameter "${paramName}", which the current route doesn't have. Please choose a different route`
+      );
+    }
+    routeParams[paramName] = value;
+  }
+  try {
+    return routes.namedRoutesMap[name](routeParams);
+  } catch {
+    throw new Error(`Could not redirect to the route named ${name}`);
+  }
+}
 const AuthenticatedRoute = ({
   unauthenticated,
+  unauthorized,
   roles,
+  userRoles,
+  orgRoles,
+  orgPermission,
   whileLoadingAuth,
   children
 }) => {
   const routerState = useRouterState();
+  const mountedOrgId = useContext(MountedOrgContext);
   const {
     loading: authLoading,
     isAuthenticated,
     hasRole
   } = routerState.useAuth();
-  const unauthorized = useCallback(() => {
-    return !(isAuthenticated && (!roles || hasRole(roles)));
-  }, [isAuthenticated, roles, hasRole]);
-  if (unauthorized()) {
+  const { pathname } = useLocation();
+  const pathParams = currentPathParams(routerState, pathname);
+  const { tenancy } = routerState;
+  const useOrg = tenancy?.useOrg ?? useNoOrg;
+  const org = useOrg(routerState.useAuth, pathParams);
+  const needsOrg = orgRoles !== void 0 || orgPermission !== void 0;
+  if (needsOrg && !org) {
+    const prop = orgRoles !== void 0 ? "orgRoles" : "orgPermission";
+    if (!tenancy) {
+      throw new Error(
+        `A PrivateSet with \`${prop}\` needs \`tenancy\` on the Router to find the organization with. Please pass \`tenancy\` from \`@cedarjs/tenancy/web\`: <Router useAuth={useAuth} tenancy={tenancy}>`
+      );
+    }
     if (authLoading) {
       return whileLoadingAuth?.() || null;
-    } else {
-      const currentLocation = globalThis.location.pathname + encodeURIComponent(globalThis.location.search);
-      const generatedRoutesMap = namedRoutes;
-      if (!generatedRoutesMap[unauthenticated]) {
-        throw new Error(`We could not find a route named ${unauthenticated}`);
+    }
+    if (pathParams["orgSlug"] === void 0) {
+      throw new Error(
+        `A PrivateSet with \`${prop}\` needs an organization to check it in, and the route has no \`orgSlug\` param. Please only use \`${prop}\` on routes with \`{orgSlug}\` in their path, or pass \`createTenancy\` a \`useOrg\` that finds the organization another way`
+      );
+    }
+    throw new Error(
+      `A PrivateSet with \`${prop}\` got no organization from the Router's \`tenancy\` for this route, so there is nothing to check it in`
+    );
+  }
+  const hasRequiredUserRoles = (!roles || hasRole(roles)) && (!userRoles || hasRole(userRoles));
+  if (isAuthenticated && hasRequiredUserRoles) {
+    if (!tenancy || !org) {
+      return /* @__PURE__ */ React.createElement(React.Fragment, null, children);
+    }
+    const { membership, memberships } = org;
+    if (!membership) {
+      if (authLoading) {
+        return whileLoadingAuth?.() || null;
       }
-      let unauthenticatedPath;
-      try {
-        unauthenticatedPath = generatedRoutesMap[unauthenticated]();
-      } catch (e) {
-        if (e instanceof Error && /Missing parameter .* for route/.test(e.message)) {
-          throw new Error(
-            `Redirecting to route "${unauthenticated}" would require route parameters, which currently is not supported. Please choose a different route`
-          );
-        }
-        throw new Error(
-          `Could not redirect to the route named ${unauthenticated}`
-        );
+      return /* @__PURE__ */ React.createElement(React.Fragment, null, tenancy.notAMember ?? null);
+    }
+    const hasRequiredOrgAccess = (orgRoles === void 0 || toList(orgRoles).includes(membership.role)) && (orgPermission === void 0 || (membership.permissions?.includes(orgPermission) ?? false));
+    if (hasRequiredOrgAccess) {
+      if (mountedOrgId === membership.organizationId) {
+        return /* @__PURE__ */ React.createElement(React.Fragment, null, children);
       }
-      return /* @__PURE__ */ React.createElement(Redirect, { to: `${unauthenticatedPath}?redirectTo=${currentLocation}` });
+      return /* @__PURE__ */ React.createElement(
+        tenancy.OrgProvider,
+        {
+          key: membership.organizationId,
+          useAuth: routerState.useAuth,
+          membership,
+          memberships
+        },
+        /* @__PURE__ */ React.createElement(MountedOrgContext.Provider, { value: membership.organizationId }, children)
+      );
     }
   }
-  return /* @__PURE__ */ React.createElement(React.Fragment, null, children);
+  if (authLoading) {
+    return whileLoadingAuth?.() || null;
+  }
+  if (isAuthenticated && unauthorized) {
+    return /* @__PURE__ */ React.createElement(
+      Redirect,
+      {
+        to: redirectPath(routerState.routes, unauthorized, pathParams),
+        options: REPLACE
+      }
+    );
+  }
+  const currentLocation = globalThis.location.pathname + encodeURIComponent(globalThis.location.search);
+  const unauthenticatedPath = redirectPath(
+    routerState.routes,
+    unauthenticated,
+    pathParams
+  );
+  return /* @__PURE__ */ React.createElement(Redirect, { to: `${unauthenticatedPath}?redirectTo=${currentLocation}` });
 };
 export {
   AuthenticatedRoute

package/dist/Set.d.ts

@@ -1,6 +1,6 @@
 import type { ComponentType, ReactElement, ReactNode } from 'react';
 import React from 'react';
-import type { AuthTenancy } from '@cedarjs/auth' with {
+import type { AuthTenancy, PermissionName } from '@cedarjs/auth' with {
     'resolution-mode': 'import'
 };
 /**
@@ -26,12 +26,42 @@ export interface WrapperProps {
  */
 export type WrapperType = ComponentType<WrapperProps>;
 /**
- * The `roles` prop, which an app with tenancy doesn't have (see
- * `AuthTenancy`): there, every role check says which kind it is.
+ * The role props. An app with tenancy (see `AuthTenancy`) has `userRoles` and
+ * `orgRoles` instead of `roles`: there, every role check says which kind it
+ * is. It also has `orgPermission`.
  */
 type SetRoles = AuthTenancy extends {
     enabled: true;
-} ? Record<never, never> : {
+} ? {
+    /**
+     * Route is permitted when authenticated and user has any of the
+     * provided roles such as "admin" or ["admin", "editor"], in
+     * `currentUser.roles`, as opposed to a role in the organization they're
+     * in (see `orgRoles`). With `orgRoles` as well, they need both.
+     */
+    userRoles?: string | string[];
+    /**
+     * Route is permitted when authenticated and user has any of the
+     * provided roles such as "owner" or ["owner", "admin"] in the current
+     * organization. With `userRoles` as well, they need both.
+     *
+     * The organization is the one the Router's `tenancy` finds for the
+     * route, by default the one with the route's `orgSlug` param:
+     *
+     *   <Router useAuth={useAuth} tenancy={tenancy}>
+     *
+     * A `PrivateSet` with `orgRoles` throws without `tenancy` on the
+     * router, or on a route that isn't in an organization.
+     */
+    orgRoles?: string | string[];
+    /**
+     * Route is permitted when authenticated and the user's membership in
+     * the current organization has this permission (see
+     * `createPermissions` in `@cedarjs/tenancy`). The organization is found
+     * like for `orgRoles`, which it can be combined with: they need both.
+     */
+    orgPermission?: PermissionName;
+} : {
     /**
      * Route is permitted when authenticated and user has any of the
      * provided roles such as "admin" or ["admin", "editor"], in
@@ -61,6 +91,13 @@ interface SetProps extends SetRoles {
      * @deprecated Please use `<PrivateSet>` instead and specify this prop there
      */
     unauthenticated?: string;
+    /**
+     * The page name where a user will be redirected when authenticated but
+     * without the required roles
+     *
+     * @deprecated Please use `<PrivateSet>` instead and specify this prop there
+     */
+    unauthorized?: string;
     /** Prerender all pages in the set */
     prerender?: boolean;
     children: ReactNode;
@@ -77,16 +114,32 @@ interface SetProps extends SetRoles {
  *   </Set>
  */
 export declare function Set(props: SetProps): React.JSX.Element;
-type PrivateSetProps = Omit<SetProps, 'private' | 'unauthenticated'> & {
-    /** The page name where a user will be redirected when not authenticated */
+type PrivateSetProps = Omit<SetProps, 'private' | 'unauthenticated' | 'unauthorized'> & {
+    /**
+     * The page name where a user will be redirected when not authenticated.
+     * Also where one without the required roles is redirected, unless the set
+     * has `unauthorized`.
+     */
     unauthenticated: string;
+    /**
+     * The page name where a user will be redirected when authenticated but
+     * without the required roles. Without it, they're redirected to
+     * `unauthenticated`.
+     */
+    unauthorized?: string;
 };
 /** @deprecated Please use `<PrivateSet>` instead */
 export declare function Private(props: PrivateSetProps): React.JSX.Element;
 /**
  * Wraps a set of routes that require the user to be authenticated before
  * rendering. Unauthenticated users are redirected to the route named by
- * `unauthenticated`.
+ * `unauthenticated`, and users without the required roles to the one named by
+ * `unauthorized`. Either route can have path params the current route has,
+ * like `orgSlug`: they're filled in from the current route.
+ *
+ * In an app with tenancy, a `PrivateSet` whose routes have `{orgSlug}` in
+ * their path provides the organization to its layouts and page, see `tenancy`
+ * on the `Router`.
  *
  * Coming from React Router or a similar library and looking for something
  * like `RequireAuth` or `ProtectedRoute`? This is the Cedar equivalent.

package/dist/Set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Set.d.ts","sourceRoot":"","sources":["../src/Set.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACnE,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;IAC/C,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,SAAS,CAAA;CACpB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;AAErD;;;GAGG;AACH,KAAK,QAAQ,GAAG,WAAW,SAAS;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GACpB;IACE;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC1B,CAAA;AAEL,UAAU,QAAS,SAAQ,QAAQ;IACjC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,WAAW,GAAG,SAAS,WAAW,EAAE,CAAA;IAC3C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;IAC5C,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,qBAIlC;AAED,KAAK,eAAe,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,GAAG,iBAAiB,CAAC,GAAG;IACrE,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,oDAAoD;AACpD,wBAAgB,OAAO,CAAC,KAAK,EAAE,eAAe,qBAI7C;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,qBAIhD;AAED,eAAO,MAAM,SAAS,GAAI,MAAM,SAAS,KAAG,IAAI,IAAI,YAAY,CAAC,QAAQ,CAOxE,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC3B,MAAM,SAAS,KACd,IAAI,IAAI,YAAY,CAAC,eAAe,CAEtC,CAAA;AAGD,eAAO,MAAM,aAAa,GACxB,MAAM,SAAS,KACd,IAAI,IAAI,YAAY,CAAC,eAAe,CAEtC,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,SAAS,aAKpB"}
+{"version":3,"file":"Set.d.ts","sourceRoot":"","sources":["../src/Set.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACnE,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;IAC/D,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,SAAS,CAAA;CACpB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;AAErD;;;;GAIG;AACH,KAAK,QAAQ,GAAG,WAAW,SAAS;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjD;IACE;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC7B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,cAAc,CAAA;CAC/B,GACD;IACE;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC1B,CAAA;AAEL,UAAU,QAAS,SAAQ,QAAQ;IACjC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,WAAW,GAAG,SAAS,WAAW,EAAE,CAAA;IAC3C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;IAC5C,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,qBAIlC;AAED,KAAK,eAAe,GAAG,IAAI,CACzB,QAAQ,EACR,SAAS,GAAG,iBAAiB,GAAG,cAAc,CAC/C,GAAG;IACF;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,oDAAoD;AACpD,wBAAgB,OAAO,CAAC,KAAK,EAAE,eAAe,qBAI7C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,qBAIhD;AAED,eAAO,MAAM,SAAS,GAAI,MAAM,SAAS,KAAG,IAAI,IAAI,YAAY,CAAC,QAAQ,CAOxE,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC3B,MAAM,SAAS,KACd,IAAI,IAAI,YAAY,CAAC,eAAe,CAEtC,CAAA;AAGD,eAAO,MAAM,aAAa,GACxB,MAAM,SAAS,KACd,IAAI,IAAI,YAAY,CAAC,eAAe,CAEtC,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,SAAS,aAKpB"}

package/dist/analyzeRoutes.d.ts

@@ -14,7 +14,11 @@ export type Wrappers = readonly WrapperType[];
 interface SetRenderProps {
     private?: boolean;
     unauthenticated?: string;
+    unauthorized?: string;
     roles?: string | string[];
+    userRoles?: string | string[];
+    orgRoles?: string | string[];
+    orgPermission?: string;
     whileLoadingAuth?: () => ReactElement | null;
 }
 interface Set {

package/dist/analyzeRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzeRoutes.d.ts","sourceRoot":"","sources":["../src/analyzeRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAGpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAQzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,WAAW,CAAA;AAElB,KAAK,gBAAgB,GAAG,MAAM,YAAY,GAAG,IAAI,CAAA;AAIjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,CACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,KACtD,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG,SAAS,WAAW,EAAE,CAAA;AAE7C;;;GAGG;AACH,UAAU,cAAc;IACtB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;CAC7C;AAED,UAAU,GAAG;IACX,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,cAAc,CAAA;CACtB;AAuCD,KAAK,SAAS,GAAG,MAAM,CAAA;AAEvB;;;;GAIG;AACH,UAAU,aAAa;IACrB,IAAI,EAAE,SAAS,CAAA;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAA;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,IAAI,EAAE,GAAG,EAAE,CAAA;CACZ;AAED,UAAU,oBAAoB;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;CAC3C;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,SAAS,EACnB,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,oBAAoB;;;;;;EAqK1D"}
+{"version":3,"file":"analyzeRoutes.d.ts","sourceRoot":"","sources":["../src/analyzeRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAGpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAQzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,WAAW,CAAA;AAElB,KAAK,gBAAgB,GAAG,MAAM,YAAY,GAAG,IAAI,CAAA;AAIjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,CACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,KACtD,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG,SAAS,WAAW,EAAE,CAAA;AAE7C;;;GAGG;AACH,UAAU,cAAc;IACtB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAEzB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;CAC7C;AAED,UAAU,GAAG;IACX,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,cAAc,CAAA;CACtB;AAuDD,KAAK,SAAS,GAAG,MAAM,CAAA;AAEvB;;;;GAIG;AACH,UAAU,aAAa;IACrB,IAAI,EAAE,SAAS,CAAA;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAA;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,IAAI,EAAE,GAAG,EAAE,CAAA;CACZ;AAED,UAAU,oBAAoB;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;CAC3C;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,SAAS,EACnB,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,oBAAoB;;;;;;EAqK1D"}

package/dist/analyzeRoutes.js

@@ -19,9 +19,21 @@ function pickSetRenderProps(props) {
   if (props.unauthenticated !== void 0) {
     picked.unauthenticated = props.unauthenticated;
   }
+  if (props.unauthorized !== void 0) {
+    picked.unauthorized = props.unauthorized;
+  }
   if (props.roles !== void 0) {
     picked.roles = props.roles;
   }
+  if (props.userRoles !== void 0) {
+    picked.userRoles = props.userRoles;
+  }
+  if (props.orgRoles !== void 0) {
+    picked.orgRoles = props.orgRoles;
+  }
+  if (props.orgPermission !== void 0) {
+    picked.orgPermission = props.orgPermission;
+  }
   if (props.whileLoadingAuth !== void 0) {
     picked.whileLoadingAuth = props.whileLoadingAuth;
   }

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export { Redirect } from './redirect.js';
 export { usePageLoadingContext, PageLoadingContextProvider, } from './PageLoadingContext.js';
 export { useParams, ParamsProvider, ParamsContext } from './params.js';
 export { Router } from './router.js';
+export type { OrgProviderProps, RouterMembership, RouterOrg, Tenancy, UseOrg, } from './router-context.js';
 export { Route } from './Route.js';
 export { namedRoutes as routes } from './namedRoutes.js';
 export { Set, Private, PrivateSet, isSetNode, isPrivateSetNode, isPrivateNode, } from './Set.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,WAAW,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAExD,OAAO,EACL,GAAG,EACH,OAAO,EACP,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,aAAa,GACd,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAEzD,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AACtE,cAAc,yBAAyB,CAAA;AACvC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACxD,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAE/B,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAE1E,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE1D;;;;;;;;;GASG;AAGH,MAAM,WAAW,eAAe;CAAG;AAGnC,cAAc,uBAAuB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,OAAO,EACP,MAAM,GACP,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,WAAW,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAExD,OAAO,EACL,GAAG,EACH,OAAO,EACP,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,aAAa,GACd,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAEzD,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AACtE,cAAc,yBAAyB,CAAA;AACvC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACxD,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAE/B,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAE1E,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE1D;;;;;;;;;GASG;AAGH,MAAM,WAAW,eAAe;CAAG;AAGnC,cAAc,uBAAuB,CAAA"}

package/dist/router-context.d.ts

@@ -4,10 +4,72 @@ import type { AuthContextInterface } from '@cedarjs/auth' with {
 };
 import type { analyzeRoutes } from './analyzeRoutes.js';
 import type { ParamType } from './util.js';
-type UseAuth = () => AuthContextInterface<unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown>;
+export type UseAuth = () => AuthContextInterface<unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown>;
+/**
+ * What the router reads of a membership in an organization. A tenancy's
+ * memberships can have more; the router passes them on to its `OrgProvider`
+ * as they are.
+ */
+export interface RouterMembership {
+    /** Identifies the organization, so one provider stays mounted across it */
+    organizationId: string;
+    /** The user's role in the organization, for `<PrivateSet orgRoles>` */
+    role: string;
+    /** What the membership may do, for `<PrivateSet orgPermission>` */
+    permissions?: readonly string[] | undefined;
+}
+/**
+ * What a tenancy's `useOrg` found for a route in an organization. A
+ * `membership` of `null` means the signed-in user isn't a member of it, or
+ * isn't signed in.
+ */
+export interface RouterOrg {
+    membership: RouterMembership | null;
+    memberships: readonly RouterMembership[];
+}
+/**
+ * Finds the organization of the current route, given the router's `useAuth`
+ * and the route's path params: `null` when the route isn't in an
+ * organization. The router calls it like a hook, on every render of a
+ * private set.
+ *
+ * One of the app's own can answer in three ways:
+ * - an organization, with the user's membership in it or `null` for none.
+ *   A set with `orgRoles` or `orgPermission` denies a user with no
+ *   membership, and the router renders the tenancy's `notAMember`.
+ * - `null`, for no organization: a set with `orgRoles` or `orgPermission`
+ *   then throws the router's own error.
+ * - throw an error of its own, such as for an organization that's been
+ *   suspended. It reaches the app's error boundary like any error thrown
+ *   while rendering.
+ */
+export type UseOrg = (useAuth: UseAuth, params: Record<string, string>) => RouterOrg | null;
+/** What the router gives a tenancy's `OrgProvider` */
+export interface OrgProviderProps {
+    useAuth: UseAuth;
+    membership: RouterMembership;
+    memberships: readonly RouterMembership[];
+    children: React.ReactNode;
+}
+/**
+ * How the router handles organizations. `createTenancy` from
+ * `@cedarjs/tenancy/web` makes one. The router renders its `OrgProvider`
+ * around the layouts and page of a `PrivateSet` whose route is in an
+ * organization, and checks `orgRoles` and `orgPermission` against the
+ * membership its `useOrg` finds.
+ */
+export interface Tenancy {
+    useOrg: UseOrg;
+    /** Provides the organization to everything below it */
+    OrgProvider: React.ComponentType<OrgProviderProps>;
+    /** Rendered for a signed-in user who isn't a member of the route's organization */
+    notAMember?: React.ReactNode;
+}
 export interface RouterState {
     paramTypes?: Record<string, ParamType>;
     useAuth: UseAuth;
+    /** Unset in apps that don't pass one to the router */
+    tenancy?: Tenancy;
     routes: ReturnType<typeof analyzeRoutes>;
     activeRouteName?: string | undefined | null;
 }
@@ -19,5 +81,4 @@ export interface RouterContextProviderProps extends Omit<RouterState, 'useAuth'>
 }
 export declare const RouterContextProvider: React.FC<RouterContextProviderProps>;
 export declare const useRouterState: () => RouterState;
-export {};
 //# sourceMappingURL=router-context.d.ts.map

package/dist/router-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router-context.d.ts","sourceRoot":"","sources":["../src/router-context.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA6C,MAAM,OAAO,CAAA;AAEjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;IACxD,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAGD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAE1C,KAAK,OAAO,GAAG,MAAM,oBAAoB,CACvC,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,CACR,CAAA;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAA;IACxC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;CAC5C;AAID,MAAM,WAAW,0BAA2B,SAAQ,IAAI,CACtD,WAAW,EACX,SAAS,CACV;IACC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAA;IACxC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;IAC3C,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAsBtE,CAAA;AAED,eAAO,MAAM,cAAc,mBAU1B,CAAA"}
+{"version":3,"file":"router-context.d.ts","sourceRoot":"","sources":["../src/router-context.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA6C,MAAM,OAAO,CAAA;AAEjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;IACxD,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAGD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAE1C,MAAM,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAC9C,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,CACR,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,cAAc,EAAE,MAAM,CAAA;IACtB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAA;IACZ,mEAAmE;IACnE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAC5C;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;CACzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,MAAM,GAAG,CACnB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,SAAS,GAAG,IAAI,CAAA;AAErB,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACxC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAA;IAClD,mFAAmF;IACnF,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAA;IACxC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;CAC5C;AAID,MAAM,WAAW,0BAA2B,SAAQ,IAAI,CACtD,WAAW,EACX,SAAS,CACV;IACC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAA;IACxC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;IAC3C,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAwBtE,CAAA;AAED,eAAO,MAAM,cAAc,mBAU1B,CAAA"}

package/dist/router-context.js

@@ -3,6 +3,7 @@ import { useNoAuth } from "@cedarjs/auth";
 const RouterStateContext = createContext(void 0);
 const RouterContextProvider = ({
   useAuth,
+  tenancy,
   paramTypes,
   routes,
   activeRouteName,
@@ -11,11 +12,12 @@ const RouterContextProvider = ({
   const state = useMemo(
     () => ({
       useAuth: useAuth || useNoAuth,
+      tenancy,
       paramTypes,
       routes,
       activeRouteName
     }),
-    [useAuth, paramTypes, routes, activeRouteName]
+    [useAuth, tenancy, paramTypes, routes, activeRouteName]
   );
   return /* @__PURE__ */ React.createElement(RouterStateContext.Provider, { value: state }, children);
 };

package/dist/router.d.ts

@@ -1,11 +1,32 @@
 import type { ReactNode } from 'react';
 import React from 'react';
-import type { RouterContextProviderProps } from './router-context.js';
+import type { AuthTenancy } from '@cedarjs/auth' with {
+    'resolution-mode': 'import'
+};
+import type { RouterContextProviderProps, Tenancy } from './router-context.js';
 import type { TrailingSlashesTypes } from './util.js';
-export interface RouterProps extends Omit<RouterContextProviderProps, 'routes' | 'activeRouteName'> {
+/**
+ * `tenancy`, only in an app with tenancy (see `AuthTenancy`), where sets have
+ * `orgRoles` and `orgPermission`
+ */
+type RouterTenancy = AuthTenancy extends {
+    enabled: true;
+} ? {
+    /**
+     * How the router handles organizations: finding the one of the current
+     * route, checking `orgRoles` and `orgPermission` in it, and providing
+     * it to the layouts and page of a `PrivateSet`. Pass the `tenancy` from
+     * `createTenancy` in `@cedarjs/tenancy/web`:
+     *
+     *   <Router useAuth={useAuth} tenancy={tenancy}>
+     */
+    tenancy?: Tenancy;
+} : Record<never, never>;
+export interface RouterProps extends Omit<RouterContextProviderProps, 'routes' | 'activeRouteName' | 'tenancy'>, RouterTenancy {
     trailingSlashes?: TrailingSlashesTypes;
     pageLoadingDelay?: number;
     children: ReactNode;
 }
 export declare const Router: React.FC<RouterProps>;
+export {};
 //# sourceMappingURL=router.d.ts.map

package/dist/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,OAAO,CAAA;AACpD,OAAO,KAAwB,MAAM,OAAO,CAAA;AAY5C,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAKrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAErD,MAAM,WAAW,WAAY,SAAQ,IAAI,CACvC,0BAA0B,EAC1B,QAAQ,GAAG,iBAAiB,CAC7B;IACC,eAAe,CAAC,EAAE,oBAAoB,CAAA;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,SAAS,CAAA;CACpB;AAED,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAoBxC,CAAA"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,OAAO,CAAA;AACpD,OAAO,KAAwB,MAAM,OAAO,CAAA;AAE5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;IAC/C,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAYD,OAAO,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAK9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAErD;;;GAGG;AACH,KAAK,aAAa,GAAG,WAAW,SAAS;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACtD;IACE;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,GACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAExB,MAAM,WAAW,WACf,SACE,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,iBAAiB,GAAG,SAAS,CAAC,EAC1E,aAAa;IACf,eAAe,CAAC,EAAE,oBAAoB,CAAA;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,SAAS,CAAA;CACpB;AAsCD,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAAwB,CAAA"}

package/dist/router.js

@@ -12,8 +12,9 @@ import { RouterContextProvider } from "./router-context.js";
 import { wrapWithSetWrappers } from "./Set.js";
 import { SplashPage } from "./splash-page.js";
 import { matchPath, parseSearch, replaceParams, validatePath } from "./util.js";
-const Router = ({
+const RouterImplementation = ({
   useAuth,
+  tenancy,
   paramTypes,
   pageLoadingDelay,
   trailingSlashes = "never",
@@ -26,6 +27,7 @@ const Router = ({
       LocationAwareRouter,
       {
         useAuth,
+        tenancy,
         paramTypes,
         pageLoadingDelay
       },
@@ -33,8 +35,11 @@ const Router = ({
     ))
   );
 };
+RouterImplementation.displayName = "Router";
+const Router = RouterImplementation;
 const LocationAwareRouter = ({
   useAuth,
+  tenancy,
   paramTypes,
   pageLoadingDelay,
   children
@@ -78,6 +83,7 @@ const LocationAwareRouter = ({
         RouterContextProvider,
         {
           useAuth,
+          tenancy,
           paramTypes,
           routes: analyzeRoutesResult
         },
@@ -122,6 +128,7 @@ const LocationAwareRouter = ({
     RouterContextProvider,
     {
       useAuth,
+      tenancy,
       paramTypes,
       routes: analyzeRoutesResult,
       activeRouteName: name
@@ -154,7 +161,11 @@ const WrappedPage = memo(({ sets, children }) => {
         AuthenticatedRoute,
         {
           unauthenticated,
+          unauthorized: set.props.unauthorized,
           roles: set.props.roles,
+          userRoles: set.props.userRoles,
+          orgRoles: set.props.orgRoles,
+          orgPermission: set.props.orgPermission,
           whileLoadingAuth: set.props.whileLoadingAuth
         },
         wrapped

package/dist/rsc/ClientRouter.d.ts

@@ -1,4 +1,4 @@
 import React from 'react';
 import type { RouterProps } from '../router.js';
-export declare const Router: ({ useAuth, paramTypes, children }: RouterProps) => React.JSX.Element;
+export declare const Router: (props: RouterProps) => React.JSX.Element;
 //# sourceMappingURL=ClientRouter.d.ts.map

package/dist/rsc/ClientRouter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ClientRouter.d.ts","sourceRoot":"","sources":["../../src/rsc/ClientRouter.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAkB,MAAM,OAAO,CAAA;AAOtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAI/C,eAAO,MAAM,MAAM,GAAI,mCAAmC,WAAW,sBASpE,CAAA"}
+{"version":3,"file":"ClientRouter.d.ts","sourceRoot":"","sources":["../../src/rsc/ClientRouter.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAkB,MAAM,OAAO,CAAA;AAOtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAI/C,eAAO,MAAM,MAAM,GAAI,OAAO,WAAW,sBAiBxC,CAAA"}

package/dist/rsc/ClientRouter.js

@@ -5,7 +5,11 @@ import { LocationProvider, useLocation } from "../location.js";
 import { namedRoutes } from "../namedRoutes.js";
 import { RouterContextProvider } from "../router-context.js";
 import { RscRoutes } from "./RscRoutes.js";
-const Router = ({ useAuth, paramTypes, children }) => {
+const Router = (props) => {
+  const { useAuth, paramTypes, children } = props;
+  if ("tenancy" in props && props.tenancy) {
+    throw new Error("`tenancy` is not supported with RSC yet");
+  }
   return (
     // Wrap it in the provider so that useLocation can be used
     /* @__PURE__ */ React.createElement(LocationProvider, null, /* @__PURE__ */ React.createElement(LocationAwareRouter, { paramTypes, useAuth }, children))
@@ -29,6 +33,14 @@ const LocationAwareRouter = ({
     return /* @__PURE__ */ React.createElement(RscRoutes, { pathname, search });
   }
   const requestedRoute = pathRouteMap[activeRoutePath];
+  for (const set of requestedRoute.sets) {
+    if (set.props.orgRoles !== void 0) {
+      throw new Error("`orgRoles` is not supported with RSC yet");
+    }
+    if (set.props.orgPermission !== void 0) {
+      throw new Error("`orgPermission` is not supported with RSC yet");
+    }
+  }
   const reversedSets = requestedRoute.sets.toReversed();
   const privateSet = reversedSets.find((set) => set.isPrivate);
   if (privateSet) {

package/dist/rsc/ServerRouter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ServerRouter.d.ts","sourceRoot":"","sources":["../../src/rsc/ServerRouter.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,OAAO,CAAA;AACpD,OAAO,KAAK,MAAM,OAAO,CAAA;AAQzB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;AAGtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAKtD,MAAM,WAAW,WAAY,SAAQ,IAAI,CACvC,0BAA0B,EAC1B,QAAQ,GAAG,iBAAiB,CAC7B;IACC,eAAe,CAAC,EAAE,oBAAoB,CAAA;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,SAAS,CAAA;CACpB;AAED,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CA4GxC,CAAA"}
+{"version":3,"file":"ServerRouter.d.ts","sourceRoot":"","sources":["../../src/rsc/ServerRouter.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,OAAO,CAAA;AACpD,OAAO,KAAK,MAAM,OAAO,CAAA;AAQzB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;AAGtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAKtD,MAAM,WAAW,WAAY,SAAQ,IAAI,CACvC,0BAA0B,EAC1B,QAAQ,GAAG,iBAAiB,CAC7B;IACC,eAAe,CAAC,EAAE,oBAAoB,CAAA;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,SAAS,CAAA;CACpB;AAED,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAqHxC,CAAA"}

package/dist/rsc/ServerRouter.js

@@ -7,7 +7,14 @@ import { wrapWithSetWrappers } from "../Set.js";
 import { SplashPage } from "../splash-page.js";
 import { matchPath, parseSearch, replaceParams, validatePath } from "../util.js";
 import { ServerRouteLoader } from "./ServerRouteLoader.js";
-const Router = ({ paramTypes, children }) => {
+const Router = ({
+  paramTypes,
+  tenancy,
+  children
+}) => {
+  if (tenancy) {
+    throw new Error("`tenancy` is not supported with RSC yet");
+  }
   const location = getLocation();
   console.log("ServerRouter.tsx location", location);
   const analyzedRoutes = analyzeRoutes(children, {
@@ -96,10 +103,19 @@ function hasRole(requiredRoles) {
 }
 const AuthenticatedRoute = ({
   children,
-  roles
+  roles,
+  userRoles,
+  orgRoles,
+  orgPermission
 }) => {
   const { isAuthenticated } = getAuthState();
-  const isAuthorized = isAuthenticated && (!roles || hasRole(roles));
+  if (orgRoles !== void 0) {
+    throw new Error("`orgRoles` is not supported with RSC yet");
+  }
+  if (orgPermission !== void 0) {
+    throw new Error("`orgPermission` is not supported with RSC yet");
+  }
+  const isAuthorized = isAuthenticated && (!roles || hasRole(roles)) && (!userRoles || hasRole(userRoles));
   if (isAuthorized) {
     return /* @__PURE__ */ React.createElement(React.Fragment, null, children);
   }
@@ -126,6 +142,9 @@ const WrappedPage = ({ routeLoaderElement, sets }) => {
         {
           unauthenticated,
           roles: set.props.roles,
+          userRoles: set.props.userRoles,
+          orgRoles: set.props.orgRoles,
+          orgPermission: set.props.orgPermission,
           whileLoadingAuth: set.props.whileLoadingAuth
         },
         wrapped

package/dist/util.d.ts

@@ -50,6 +50,16 @@ export declare function matchPath(routeDefinition: string, pathname: string, { u
     match: boolean;
     params: Record<string, unknown>;
 };
+/**
+ * The path params of `pathname` for the route `routeDefinition`, as the text
+ * in the path, without parsing them with their param types. For putting into
+ * another route's path, where a parsed value (whatever a custom type's `parse`
+ * returns, say) wouldn't be the same text.
+ *
+ *  pathParamsText('/post/{id:Int}', '/post/7')
+ *  => { id: '7' }
+ */
+export declare function pathParamsText(routeDefinition: string, pathname: string, userParamTypes?: Record<string, ParamType>): Record<string, string>;
 interface GetRouteRegexOptions {
     matchSubPaths?: boolean;
     allParamTypes?: Record<string, ParamType>;

package/dist/util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,cAyB3C;AAED,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAA;AAElE,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAA;CAChC;AAwBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,SAAS,CACvB,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,MAAM,EAChB,EACE,cAAc,EACd,aAAa,GACd,GAAE;IACD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC1C,aAAa,CAAC,EAAE,OAAO,CAAA;CAIxB;;;;;;EA2CF;AAED,UAAU,oBAAoB;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;CAC1C;AACD;;;;;GAKG;AAEH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,EACE,aAAqB,EACrB,aAA8B,GAC/B,GAAE,oBAAoB,GAAG,SAAc;;;;EA+BzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,MAAM,EACJ,MAAM,GAAG,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,eAAe,GAAG,SAAS,MAW7E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAyC3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,UAgCnC;AAED,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAExE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,6BAQtD;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,YAMvB"}
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,cA0B3C;AAED,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAA;AAElE,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAA;CAChC;AAwBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,SAAS,CACvB,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,MAAM,EAChB,EACE,cAAc,EACd,aAAa,GACd,GAAE;IACD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC1C,aAAa,CAAC,EAAE,OAAO,CAAA;CAIxB;;;;;;EA2CF;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,MAAM,EAChB,cAAc,GAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAM,0BAgB/C;AAED,UAAU,oBAAoB;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;CAC1C;AACD;;;;;GAKG;AAEH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,EACE,aAAqB,EACrB,aAA8B,GAC/B,GAAE,oBAAoB,GAAG,SAAc;;;;EA+BzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,MAAM,EACJ,MAAM,GAAG,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,eAAe,GAAG,SAAS,MAW7E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAyC3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,UAiCnC;AAED,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAExE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,6BAQtD;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,YAMvB"}

package/dist/util.js

@@ -1,5 +1,5 @@
 function paramsForRoute(route) {
-  const params = [...route.matchAll(/\{([^}]+)\}/g)];
+  const params = [...route.matchAll(/\{([^{}]+)\}/g)];
   return params.map((match) => match[1]).map((match) => {
     const parts = match.split(":");
     let name = parts[0];
@@ -70,6 +70,19 @@ function matchPath(routeDefinition, pathname, {
   }
   return { match: true };
 }
+function pathParamsText(routeDefinition, pathname, userParamTypes = {}) {
+  const { matchRegex, routeParams } = getRouteRegexAndParams(routeDefinition, {
+    allParamTypes: { ...coreParamTypes, ...userParamTypes }
+  });
+  const match = matchRegex.exec(pathname);
+  const params = {};
+  if (match) {
+    routeParams.forEach(([name], index) => {
+      params[name] = match[index + 1];
+    });
+  }
+  return params;
+}
 function getRouteRegexAndParams(route, {
   matchSubPaths = false,
   allParamTypes = coreParamTypes
@@ -140,7 +153,7 @@ function replaceParams(route, args = {}) {
     const [name, _type, match] = param;
     const value = args[name];
     if (value !== void 0) {
-      path = path.replace(match, value);
+      path = path.replace(match, () => String(value));
     } else {
       throw new Error(
         `Missing parameter '${name}' for route '${route}' when generating a navigation URL.`
@@ -178,6 +191,7 @@ export {
   matchPath,
   paramsForRoute,
   parseSearch,
+  pathParamsText,
   replaceParams,
   validatePath
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/router",
-  "version": "8.0.0-canary.3541",
+  "version": "8.0.0-canary.3545",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -52,15 +52,15 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/project-config": "8.0.0-canary.3541",
-    "@cedarjs/server-store": "8.0.0-canary.3541",
+    "@cedarjs/project-config": "8.0.0-canary.3545",
+    "@cedarjs/server-store": "8.0.0-canary.3545",
     "react-server-dom-webpack": "19.3.1",
     "ts-toolbelt": "9.6.0"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
-    "@cedarjs/auth": "8.0.0-canary.3541",
-    "@cedarjs/framework-tools": "8.0.0-canary.3541",
+    "@cedarjs/auth": "8.0.0-canary.3545",
+    "@cedarjs/framework-tools": "8.0.0-canary.3545",
     "@testing-library/jest-dom": "6.9.1",
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",
@@ -74,7 +74,7 @@
     "vitest": "4.1.12"
   },
   "peerDependencies": {
-    "@cedarjs/auth": "8.0.0-canary.3541",
+    "@cedarjs/auth": "8.0.0-canary.3545",
     "react": "19.3.1",
     "react-dom": "19.3.1"
   },