@cedarjs/router 8.0.0-canary.3542 → 8.0.0-canary.3545

package/dist/AuthenticatedRoute.d.ts

@@ -1,9 +1,10 @@
 import React from 'react';
 interface AuthenticatedRouteProps {
-    children: React.ReactNode | Thenable<React.ReactNode>;
+    children: React.ReactNode;
     roles?: string | string[];
     userRoles?: string | string[];
     orgRoles?: string | string[];
+    orgPermission?: string;
     unauthenticated: string;
     unauthorized?: string;
     whileLoadingAuth?: () => React.ReactElement | null;

package/dist/AuthenticatedRoute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticatedRoute.d.ts","sourceRoot":"","sources":["../src/AuthenticatedRoute.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAQzB,UAAU,uBAAuB;IAC/B,QAAQ,EAAE,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACrD,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,MAAM,KAAK,CAAC,YAAY,GAAG,IAAI,CAAA;CACnD;AAsED,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CA4FhE,CAAA"}
+{"version":3,"file":"AuthenticatedRoute.d.ts","sourceRoot":"","sources":["../src/AuthenticatedRoute.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAoC,MAAM,OAAO,CAAA;AAQxD,UAAU,uBAAuB;IAC/B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,MAAM,KAAK,CAAC,YAAY,GAAG,IAAI,CAAA;CACnD;AAgFD,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAkJhE,CAAA"}

package/dist/AuthenticatedRoute.js

@@ -1,10 +1,12 @@
-import React from "react";
+import React, { createContext, useContext } from "react";
 import { useLocation } from "./location.js";
 import { Redirect } from "./redirect.js";
 import { useRouterState } from "./router-context.js";
 import { paramsForRoute, pathParamsText } from "./util.js";
 const REPLACE = { replace: true };
-const useNoOrgRoles = () => null;
+const useNoOrg = () => null;
+const MountedOrgContext = createContext(void 0);
+const toList = (roles) => Array.isArray(roles) ? roles : [roles];
 function currentPathParams(routerState, pathname) {
   const route = Object.values(routerState.routes.pathRouteMap).find(
     (candidate) => candidate.name === routerState.activeRouteName
@@ -46,10 +48,12 @@ const AuthenticatedRoute = ({
   roles,
   userRoles,
   orgRoles,
+  orgPermission,
   whileLoadingAuth,
   children
 }) => {
   const routerState = useRouterState();
+  const mountedOrgId = useContext(MountedOrgContext);
   const {
     loading: authLoading,
     isAuthenticated,
@@ -57,26 +61,57 @@ const AuthenticatedRoute = ({
   } = routerState.useAuth();
   const { pathname } = useLocation();
   const pathParams = currentPathParams(routerState, pathname);
-  const useOrgRoles = routerState.useOrgRoles ?? useNoOrgRoles;
-  const hasOrgRole = useOrgRoles(routerState.useAuth, pathParams);
-  if (orgRoles !== void 0 && !hasOrgRole) {
-    if (!routerState.useOrgRoles) {
+  const { tenancy } = routerState;
+  const useOrg = tenancy?.useOrg ?? useNoOrg;
+  const org = useOrg(routerState.useAuth, pathParams);
+  const needsOrg = orgRoles !== void 0 || orgPermission !== void 0;
+  if (needsOrg && !org) {
+    const prop = orgRoles !== void 0 ? "orgRoles" : "orgPermission";
+    if (!tenancy) {
       throw new Error(
-        "A PrivateSet with `orgRoles` needs `useOrgRoles` on the Router to check the role with. Please pass `useOrgRoles` from `@cedarjs/tenancy/web`: <Router useAuth={useAuth} useOrgRoles={useOrgRoles}>"
+        `A PrivateSet with \`${prop}\` needs \`tenancy\` on the Router to find the organization with. Please pass \`tenancy\` from \`@cedarjs/tenancy/web\`: <Router useAuth={useAuth} tenancy={tenancy}>`
       );
     }
+    if (authLoading) {
+      return whileLoadingAuth?.() || null;
+    }
     if (pathParams["orgSlug"] === void 0) {
       throw new Error(
-        "A PrivateSet with `orgRoles` needs an organization to check the role in, and the route has no `orgSlug` param. Please only use `orgRoles` on routes with `{orgSlug}` in their path, or pass the Router a `useOrgRoles` that finds the organization another way"
+        `A PrivateSet with \`${prop}\` needs an organization to check it in, and the route has no \`orgSlug\` param. Please only use \`${prop}\` on routes with \`{orgSlug}\` in their path, or pass \`createTenancy\` a \`useOrg\` that finds the organization another way`
       );
     }
     throw new Error(
-      "A PrivateSet with `orgRoles` got no role check from the Router's `useOrgRoles` for this route, so there is no organization to check the role in"
+      `A PrivateSet with \`${prop}\` got no organization from the Router's \`tenancy\` for this route, so there is nothing to check it in`
     );
   }
-  const hasRequiredRoles = (!roles || hasRole(roles)) && (!userRoles || hasRole(userRoles)) && (orgRoles === void 0 || !!hasOrgRole && hasOrgRole(orgRoles));
-  if (isAuthenticated && hasRequiredRoles) {
-    return /* @__PURE__ */ React.createElement(React.Fragment, null, children);
+  const hasRequiredUserRoles = (!roles || hasRole(roles)) && (!userRoles || hasRole(userRoles));
+  if (isAuthenticated && hasRequiredUserRoles) {
+    if (!tenancy || !org) {
+      return /* @__PURE__ */ React.createElement(React.Fragment, null, children);
+    }
+    const { membership, memberships } = org;
+    if (!membership) {
+      if (authLoading) {
+        return whileLoadingAuth?.() || null;
+      }
+      return /* @__PURE__ */ React.createElement(React.Fragment, null, tenancy.notAMember ?? null);
+    }
+    const hasRequiredOrgAccess = (orgRoles === void 0 || toList(orgRoles).includes(membership.role)) && (orgPermission === void 0 || (membership.permissions?.includes(orgPermission) ?? false));
+    if (hasRequiredOrgAccess) {
+      if (mountedOrgId === membership.organizationId) {
+        return /* @__PURE__ */ React.createElement(React.Fragment, null, children);
+      }
+      return /* @__PURE__ */ React.createElement(
+        tenancy.OrgProvider,
+        {
+          key: membership.organizationId,
+          useAuth: routerState.useAuth,
+          membership,
+          memberships
+        },
+        /* @__PURE__ */ React.createElement(MountedOrgContext.Provider, { value: membership.organizationId }, children)
+      );
+    }
   }
   if (authLoading) {
     return whileLoadingAuth?.() || null;

package/dist/Set.d.ts

@@ -1,6 +1,6 @@
 import type { ComponentType, ReactElement, ReactNode } from 'react';
 import React from 'react';
-import type { AuthTenancy } from '@cedarjs/auth' with {
+import type { AuthTenancy, PermissionName } from '@cedarjs/auth' with {
     'resolution-mode': 'import'
 };
 /**
@@ -28,7 +28,7 @@ export type WrapperType = ComponentType<WrapperProps>;
 /**
  * The role props. An app with tenancy (see `AuthTenancy`) has `userRoles` and
  * `orgRoles` instead of `roles`: there, every role check says which kind it
- * is.
+ * is. It also has `orgPermission`.
  */
 type SetRoles = AuthTenancy extends {
     enabled: true;
@@ -45,15 +45,22 @@ type SetRoles = AuthTenancy extends {
      * provided roles such as "owner" or ["owner", "admin"] in the current
      * organization. With `userRoles` as well, they need both.
      *
-     * The organization is the one with the route's `orgSlug` param, and
-     * the router checks the role with the `useOrgRoles` passed to it:
+     * The organization is the one the Router's `tenancy` finds for the
+     * route, by default the one with the route's `orgSlug` param:
      *
-     *   <Router useAuth={useAuth} useOrgRoles={useOrgRoles}>
+     *   <Router useAuth={useAuth} tenancy={tenancy}>
      *
-     * A `PrivateSet` with `orgRoles` throws without `useOrgRoles` on the
-     * router, or on a route without `{orgSlug}` in its path.
+     * A `PrivateSet` with `orgRoles` throws without `tenancy` on the
+     * router, or on a route that isn't in an organization.
      */
     orgRoles?: string | string[];
+    /**
+     * Route is permitted when authenticated and the user's membership in
+     * the current organization has this permission (see
+     * `createPermissions` in `@cedarjs/tenancy`). The organization is found
+     * like for `orgRoles`, which it can be combined with: they need both.
+     */
+    orgPermission?: PermissionName;
 } : {
     /**
      * Route is permitted when authenticated and user has any of the
@@ -130,6 +137,10 @@ export declare function Private(props: PrivateSetProps): React.JSX.Element;
  * `unauthorized`. Either route can have path params the current route has,
  * like `orgSlug`: they're filled in from the current route.
  *
+ * In an app with tenancy, a `PrivateSet` whose routes have `{orgSlug}` in
+ * their path provides the organization to its layouts and page, see `tenancy`
+ * on the `Router`.
+ *
  * Coming from React Router or a similar library and looking for something
  * like `RequireAuth` or `ProtectedRoute`? This is the Cedar equivalent.
  */

package/dist/Set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Set.d.ts","sourceRoot":"","sources":["../src/Set.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACnE,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;IAC/C,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,SAAS,CAAA;CACpB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;AAErD;;;;GAIG;AACH,KAAK,QAAQ,GAAG,WAAW,SAAS;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjD;IACE;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC7B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC7B,GACD;IACE;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC1B,CAAA;AAEL,UAAU,QAAS,SAAQ,QAAQ;IACjC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,WAAW,GAAG,SAAS,WAAW,EAAE,CAAA;IAC3C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;IAC5C,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,qBAIlC;AAED,KAAK,eAAe,GAAG,IAAI,CACzB,QAAQ,EACR,SAAS,GAAG,iBAAiB,GAAG,cAAc,CAC/C,GAAG;IACF;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,oDAAoD;AACpD,wBAAgB,OAAO,CAAC,KAAK,EAAE,eAAe,qBAI7C;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,qBAIhD;AAED,eAAO,MAAM,SAAS,GAAI,MAAM,SAAS,KAAG,IAAI,IAAI,YAAY,CAAC,QAAQ,CAOxE,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC3B,MAAM,SAAS,KACd,IAAI,IAAI,YAAY,CAAC,eAAe,CAEtC,CAAA;AAGD,eAAO,MAAM,aAAa,GACxB,MAAM,SAAS,KACd,IAAI,IAAI,YAAY,CAAC,eAAe,CAEtC,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,SAAS,aAKpB"}
+{"version":3,"file":"Set.d.ts","sourceRoot":"","sources":["../src/Set.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACnE,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;IAC/D,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,SAAS,CAAA;CACpB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;AAErD;;;;GAIG;AACH,KAAK,QAAQ,GAAG,WAAW,SAAS;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjD;IACE;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC7B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,cAAc,CAAA;CAC/B,GACD;IACE;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC1B,CAAA;AAEL,UAAU,QAAS,SAAQ,QAAQ;IACjC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,WAAW,GAAG,SAAS,WAAW,EAAE,CAAA;IAC3C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;IAC5C,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,qBAIlC;AAED,KAAK,eAAe,GAAG,IAAI,CACzB,QAAQ,EACR,SAAS,GAAG,iBAAiB,GAAG,cAAc,CAC/C,GAAG;IACF;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,oDAAoD;AACpD,wBAAgB,OAAO,CAAC,KAAK,EAAE,eAAe,qBAI7C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,qBAIhD;AAED,eAAO,MAAM,SAAS,GAAI,MAAM,SAAS,KAAG,IAAI,IAAI,YAAY,CAAC,QAAQ,CAOxE,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC3B,MAAM,SAAS,KACd,IAAI,IAAI,YAAY,CAAC,eAAe,CAEtC,CAAA;AAGD,eAAO,MAAM,aAAa,GACxB,MAAM,SAAS,KACd,IAAI,IAAI,YAAY,CAAC,eAAe,CAEtC,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,SAAS,aAKpB"}

package/dist/analyzeRoutes.d.ts

@@ -18,6 +18,7 @@ interface SetRenderProps {
     roles?: string | string[];
     userRoles?: string | string[];
     orgRoles?: string | string[];
+    orgPermission?: string;
     whileLoadingAuth?: () => ReactElement | null;
 }
 interface Set {

package/dist/analyzeRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzeRoutes.d.ts","sourceRoot":"","sources":["../src/analyzeRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAGpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAQzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,WAAW,CAAA;AAElB,KAAK,gBAAgB,GAAG,MAAM,YAAY,GAAG,IAAI,CAAA;AAIjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,CACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,KACtD,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG,SAAS,WAAW,EAAE,CAAA;AAE7C;;;GAGG;AACH,UAAU,cAAc;IACtB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAEzB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;CAC7C;AAED,UAAU,GAAG;IACX,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,cAAc,CAAA;CACtB;AAmDD,KAAK,SAAS,GAAG,MAAM,CAAA;AAEvB;;;;GAIG;AACH,UAAU,aAAa;IACrB,IAAI,EAAE,SAAS,CAAA;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAA;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,IAAI,EAAE,GAAG,EAAE,CAAA;CACZ;AAED,UAAU,oBAAoB;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;CAC3C;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,SAAS,EACnB,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,oBAAoB;;;;;;EAqK1D"}
+{"version":3,"file":"analyzeRoutes.d.ts","sourceRoot":"","sources":["../src/analyzeRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAGpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAQzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,WAAW,CAAA;AAElB,KAAK,gBAAgB,GAAG,MAAM,YAAY,GAAG,IAAI,CAAA;AAIjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,CACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,KACtD,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG,SAAS,WAAW,EAAE,CAAA;AAE7C;;;GAGG;AACH,UAAU,cAAc;IACtB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAEzB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;CAC7C;AAED,UAAU,GAAG;IACX,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,cAAc,CAAA;CACtB;AAuDD,KAAK,SAAS,GAAG,MAAM,CAAA;AAEvB;;;;GAIG;AACH,UAAU,aAAa;IACrB,IAAI,EAAE,SAAS,CAAA;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAA;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,IAAI,EAAE,GAAG,EAAE,CAAA;CACZ;AAED,UAAU,oBAAoB;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;CAC3C;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,SAAS,EACnB,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,oBAAoB;;;;;;EAqK1D"}

package/dist/analyzeRoutes.js

@@ -31,6 +31,9 @@ function pickSetRenderProps(props) {
   if (props.orgRoles !== void 0) {
     picked.orgRoles = props.orgRoles;
   }
+  if (props.orgPermission !== void 0) {
+    picked.orgPermission = props.orgPermission;
+  }
   if (props.whileLoadingAuth !== void 0) {
     picked.whileLoadingAuth = props.whileLoadingAuth;
   }

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export { Redirect } from './redirect.js';
 export { usePageLoadingContext, PageLoadingContextProvider, } from './PageLoadingContext.js';
 export { useParams, ParamsProvider, ParamsContext } from './params.js';
 export { Router } from './router.js';
-export type { UseOrgRoles } from './router-context.js';
+export type { OrgProviderProps, RouterMembership, RouterOrg, Tenancy, UseOrg, } from './router-context.js';
 export { Route } from './Route.js';
 export { namedRoutes as routes } from './namedRoutes.js';
 export { Set, Private, PrivateSet, isSetNode, isPrivateSetNode, isPrivateNode, } from './Set.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,WAAW,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAExD,OAAO,EACL,GAAG,EACH,OAAO,EACP,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,aAAa,GACd,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAEzD,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AACtE,cAAc,yBAAyB,CAAA;AACvC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACxD,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAE/B,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAE1E,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE1D;;;;;;;;;GASG;AAGH,MAAM,WAAW,eAAe;CAAG;AAGnC,cAAc,uBAAuB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,OAAO,EACP,MAAM,GACP,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,WAAW,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAExD,OAAO,EACL,GAAG,EACH,OAAO,EACP,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,aAAa,GACd,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAEzD,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AACtE,cAAc,yBAAyB,CAAA;AACvC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACxD,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAE/B,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAE1E,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE1D;;;;;;;;;GASG;AAGH,MAAM,WAAW,eAAe;CAAG;AAGnC,cAAc,uBAAuB,CAAA"}

package/dist/router-context.d.ts

@@ -4,29 +4,72 @@ import type { AuthContextInterface } from '@cedarjs/auth' with {
 };
 import type { analyzeRoutes } from './analyzeRoutes.js';
 import type { ParamType } from './util.js';
-type UseAuth = () => AuthContextInterface<unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown>;
+export type UseAuth = () => AuthContextInterface<unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown>;
 /**
- * Checks the user's role in the organization of the current route, for
- * `<PrivateSet orgRoles>`, given the router's `useAuth` and the route's path
- * params: `null` when the route isn't in an organization. In apps with
- * tenancy, `useOrgRoles` from `@cedarjs/tenancy/web` is one. The router
- * calls it like a hook, on every render of a private set.
+ * What the router reads of a membership in an organization. A tenancy's
+ * memberships can have more; the router passes them on to its `OrgProvider`
+ * as they are.
+ */
+export interface RouterMembership {
+    /** Identifies the organization, so one provider stays mounted across it */
+    organizationId: string;
+    /** The user's role in the organization, for `<PrivateSet orgRoles>` */
+    role: string;
+    /** What the membership may do, for `<PrivateSet orgPermission>` */
+    permissions?: readonly string[] | undefined;
+}
+/**
+ * What a tenancy's `useOrg` found for a route in an organization. A
+ * `membership` of `null` means the signed-in user isn't a member of it, or
+ * isn't signed in.
+ */
+export interface RouterOrg {
+    membership: RouterMembership | null;
+    memberships: readonly RouterMembership[];
+}
+/**
+ * Finds the organization of the current route, given the router's `useAuth`
+ * and the route's path params: `null` when the route isn't in an
+ * organization. The router calls it like a hook, on every render of a
+ * private set.
  *
  * One of the app's own can answer in three ways:
- * - a check, which the router uses for `orgRoles`. One that always returns
- *   `false` denies access and redirects to `unauthorized`.
- * - `null`, for no organization: a set with `orgRoles` then throws the
- *   router's own error.
+ * - an organization, with the user's membership in it or `null` for none.
+ *   A set with `orgRoles` or `orgPermission` denies a user with no
+ *   membership, and the router renders the tenancy's `notAMember`.
+ * - `null`, for no organization: a set with `orgRoles` or `orgPermission`
+ *   then throws the router's own error.
  * - throw an error of its own, such as for an organization that's been
  *   suspended. It reaches the app's error boundary like any error thrown
  *   while rendering.
  */
-export type UseOrgRoles = (useAuth: UseAuth, params: Record<string, string>) => ((roles: string | string[]) => boolean) | null;
+export type UseOrg = (useAuth: UseAuth, params: Record<string, string>) => RouterOrg | null;
+/** What the router gives a tenancy's `OrgProvider` */
+export interface OrgProviderProps {
+    useAuth: UseAuth;
+    membership: RouterMembership;
+    memberships: readonly RouterMembership[];
+    children: React.ReactNode;
+}
+/**
+ * How the router handles organizations. `createTenancy` from
+ * `@cedarjs/tenancy/web` makes one. The router renders its `OrgProvider`
+ * around the layouts and page of a `PrivateSet` whose route is in an
+ * organization, and checks `orgRoles` and `orgPermission` against the
+ * membership its `useOrg` finds.
+ */
+export interface Tenancy {
+    useOrg: UseOrg;
+    /** Provides the organization to everything below it */
+    OrgProvider: React.ComponentType<OrgProviderProps>;
+    /** Rendered for a signed-in user who isn't a member of the route's organization */
+    notAMember?: React.ReactNode;
+}
 export interface RouterState {
     paramTypes?: Record<string, ParamType>;
     useAuth: UseAuth;
     /** Unset in apps that don't pass one to the router */
-    useOrgRoles?: UseOrgRoles;
+    tenancy?: Tenancy;
     routes: ReturnType<typeof analyzeRoutes>;
     activeRouteName?: string | undefined | null;
 }
@@ -38,5 +81,4 @@ export interface RouterContextProviderProps extends Omit<RouterState, 'useAuth'>
 }
 export declare const RouterContextProvider: React.FC<RouterContextProviderProps>;
 export declare const useRouterState: () => RouterState;
-export {};
 //# sourceMappingURL=router-context.d.ts.map

package/dist/router-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router-context.d.ts","sourceRoot":"","sources":["../src/router-context.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA6C,MAAM,OAAO,CAAA;AAEjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;IACxD,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAGD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAE1C,KAAK,OAAO,GAAG,MAAM,oBAAoB,CACvC,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,CACR,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,IAAI,CAAA;AAEnD,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,sDAAsD;IACtD,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAA;IACxC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;CAC5C;AAID,MAAM,WAAW,0BAA2B,SAAQ,IAAI,CACtD,WAAW,EACX,SAAS,CACV;IACC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAA;IACxC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;IAC3C,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAwBtE,CAAA;AAED,eAAO,MAAM,cAAc,mBAU1B,CAAA"}
+{"version":3,"file":"router-context.d.ts","sourceRoot":"","sources":["../src/router-context.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA6C,MAAM,OAAO,CAAA;AAEjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;IACxD,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAGD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAE1C,MAAM,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAC9C,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,CACR,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,cAAc,EAAE,MAAM,CAAA;IACtB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAA;IACZ,mEAAmE;IACnE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAC5C;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;CACzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,MAAM,GAAG,CACnB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,SAAS,GAAG,IAAI,CAAA;AAErB,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACxC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAA;IAClD,mFAAmF;IACnF,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAA;IACxC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;CAC5C;AAID,MAAM,WAAW,0BAA2B,SAAQ,IAAI,CACtD,WAAW,EACX,SAAS,CACV;IACC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAA;IACxC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;IAC3C,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAwBtE,CAAA;AAED,eAAO,MAAM,cAAc,mBAU1B,CAAA"}

package/dist/router-context.js

@@ -3,7 +3,7 @@ import { useNoAuth } from "@cedarjs/auth";
 const RouterStateContext = createContext(void 0);
 const RouterContextProvider = ({
   useAuth,
-  useOrgRoles,
+  tenancy,
   paramTypes,
   routes,
   activeRouteName,
@@ -12,12 +12,12 @@ const RouterContextProvider = ({
   const state = useMemo(
     () => ({
       useAuth: useAuth || useNoAuth,
-      useOrgRoles,
+      tenancy,
       paramTypes,
       routes,
       activeRouteName
     }),
-    [useAuth, useOrgRoles, paramTypes, routes, activeRouteName]
+    [useAuth, tenancy, paramTypes, routes, activeRouteName]
   );
   return /* @__PURE__ */ React.createElement(RouterStateContext.Provider, { value: state }, children);
 };

package/dist/router.d.ts

@@ -3,25 +3,26 @@ import React from 'react';
 import type { AuthTenancy } from '@cedarjs/auth' with {
     'resolution-mode': 'import'
 };
-import type { RouterContextProviderProps, UseOrgRoles } from './router-context.js';
+import type { RouterContextProviderProps, Tenancy } from './router-context.js';
 import type { TrailingSlashesTypes } from './util.js';
 /**
- * `useOrgRoles`, only in an app with tenancy (see `AuthTenancy`), where sets
- * have `orgRoles`
+ * `tenancy`, only in an app with tenancy (see `AuthTenancy`), where sets have
+ * `orgRoles` and `orgPermission`
  */
-type RouterOrgRoles = AuthTenancy extends {
+type RouterTenancy = AuthTenancy extends {
     enabled: true;
 } ? {
     /**
-     * Checks the user's role in the organization of the current route, for
-     * `<PrivateSet orgRoles>`. Pass `useOrgRoles` from
-     * `@cedarjs/tenancy/web`:
+     * How the router handles organizations: finding the one of the current
+     * route, checking `orgRoles` and `orgPermission` in it, and providing
+     * it to the layouts and page of a `PrivateSet`. Pass the `tenancy` from
+     * `createTenancy` in `@cedarjs/tenancy/web`:
      *
-     *   <Router useAuth={useAuth} useOrgRoles={useOrgRoles}>
+     *   <Router useAuth={useAuth} tenancy={tenancy}>
      */
-    useOrgRoles?: UseOrgRoles;
+    tenancy?: Tenancy;
 } : Record<never, never>;
-export interface RouterProps extends Omit<RouterContextProviderProps, 'routes' | 'activeRouteName' | 'useOrgRoles'>, RouterOrgRoles {
+export interface RouterProps extends Omit<RouterContextProviderProps, 'routes' | 'activeRouteName' | 'tenancy'>, RouterTenancy {
     trailingSlashes?: TrailingSlashesTypes;
     pageLoadingDelay?: number;
     children: ReactNode;

package/dist/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,OAAO,CAAA;AACpD,OAAO,KAAwB,MAAM,OAAO,CAAA;AAE5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;IAC/C,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAYD,OAAO,KAAK,EACV,0BAA0B,EAC1B,WAAW,EACZ,MAAM,qBAAqB,CAAA;AAK5B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAErD;;;GAGG;AACH,KAAK,cAAc,GAAG,WAAW,SAAS;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACvD;IACE;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B,GACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAExB,MAAM,WAAW,WACf,SACE,IAAI,CACF,0BAA0B,EAC1B,QAAQ,GAAG,iBAAiB,GAAG,aAAa,CAC7C,EACD,cAAc;IAChB,eAAe,CAAC,EAAE,oBAAoB,CAAA;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,SAAS,CAAA;CACpB;AAsCD,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAAwB,CAAA"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,OAAO,CAAA;AACpD,OAAO,KAAwB,MAAM,OAAO,CAAA;AAE5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;IAC/C,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAYD,OAAO,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAK9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAErD;;;GAGG;AACH,KAAK,aAAa,GAAG,WAAW,SAAS;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACtD;IACE;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,GACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAExB,MAAM,WAAW,WACf,SACE,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,iBAAiB,GAAG,SAAS,CAAC,EAC1E,aAAa;IACf,eAAe,CAAC,EAAE,oBAAoB,CAAA;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,SAAS,CAAA;CACpB;AAsCD,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAAwB,CAAA"}

package/dist/router.js

@@ -14,7 +14,7 @@ import { SplashPage } from "./splash-page.js";
 import { matchPath, parseSearch, replaceParams, validatePath } from "./util.js";
 const RouterImplementation = ({
   useAuth,
-  useOrgRoles,
+  tenancy,
   paramTypes,
   pageLoadingDelay,
   trailingSlashes = "never",
@@ -27,7 +27,7 @@ const RouterImplementation = ({
       LocationAwareRouter,
       {
         useAuth,
-        useOrgRoles,
+        tenancy,
         paramTypes,
         pageLoadingDelay
       },
@@ -39,7 +39,7 @@ RouterImplementation.displayName = "Router";
 const Router = RouterImplementation;
 const LocationAwareRouter = ({
   useAuth,
-  useOrgRoles,
+  tenancy,
   paramTypes,
   pageLoadingDelay,
   children
@@ -83,7 +83,7 @@ const LocationAwareRouter = ({
         RouterContextProvider,
         {
           useAuth,
-          useOrgRoles,
+          tenancy,
           paramTypes,
           routes: analyzeRoutesResult
         },
@@ -128,7 +128,7 @@ const LocationAwareRouter = ({
     RouterContextProvider,
     {
       useAuth,
-      useOrgRoles,
+      tenancy,
       paramTypes,
       routes: analyzeRoutesResult,
       activeRouteName: name
@@ -165,6 +165,7 @@ const WrappedPage = memo(({ sets, children }) => {
           roles: set.props.roles,
           userRoles: set.props.userRoles,
           orgRoles: set.props.orgRoles,
+          orgPermission: set.props.orgPermission,
           whileLoadingAuth: set.props.whileLoadingAuth
         },
         wrapped

package/dist/rsc/ClientRouter.d.ts

@@ -1,4 +1,4 @@
 import React from 'react';
 import type { RouterProps } from '../router.js';
-export declare const Router: ({ useAuth, paramTypes, children }: RouterProps) => React.JSX.Element;
+export declare const Router: (props: RouterProps) => React.JSX.Element;
 //# sourceMappingURL=ClientRouter.d.ts.map

package/dist/rsc/ClientRouter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ClientRouter.d.ts","sourceRoot":"","sources":["../../src/rsc/ClientRouter.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAkB,MAAM,OAAO,CAAA;AAOtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAI/C,eAAO,MAAM,MAAM,GAAI,mCAAmC,WAAW,sBASpE,CAAA"}
+{"version":3,"file":"ClientRouter.d.ts","sourceRoot":"","sources":["../../src/rsc/ClientRouter.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAkB,MAAM,OAAO,CAAA;AAOtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAI/C,eAAO,MAAM,MAAM,GAAI,OAAO,WAAW,sBAiBxC,CAAA"}

package/dist/rsc/ClientRouter.js

@@ -5,7 +5,11 @@ import { LocationProvider, useLocation } from "../location.js";
 import { namedRoutes } from "../namedRoutes.js";
 import { RouterContextProvider } from "../router-context.js";
 import { RscRoutes } from "./RscRoutes.js";
-const Router = ({ useAuth, paramTypes, children }) => {
+const Router = (props) => {
+  const { useAuth, paramTypes, children } = props;
+  if ("tenancy" in props && props.tenancy) {
+    throw new Error("`tenancy` is not supported with RSC yet");
+  }
   return (
     // Wrap it in the provider so that useLocation can be used
     /* @__PURE__ */ React.createElement(LocationProvider, null, /* @__PURE__ */ React.createElement(LocationAwareRouter, { paramTypes, useAuth }, children))
@@ -29,6 +33,14 @@ const LocationAwareRouter = ({
     return /* @__PURE__ */ React.createElement(RscRoutes, { pathname, search });
   }
   const requestedRoute = pathRouteMap[activeRoutePath];
+  for (const set of requestedRoute.sets) {
+    if (set.props.orgRoles !== void 0) {
+      throw new Error("`orgRoles` is not supported with RSC yet");
+    }
+    if (set.props.orgPermission !== void 0) {
+      throw new Error("`orgPermission` is not supported with RSC yet");
+    }
+  }
   const reversedSets = requestedRoute.sets.toReversed();
   const privateSet = reversedSets.find((set) => set.isPrivate);
   if (privateSet) {

package/dist/rsc/ServerRouter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ServerRouter.d.ts","sourceRoot":"","sources":["../../src/rsc/ServerRouter.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,OAAO,CAAA;AACpD,OAAO,KAAK,MAAM,OAAO,CAAA;AAQzB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;AAGtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAKtD,MAAM,WAAW,WAAY,SAAQ,IAAI,CACvC,0BAA0B,EAC1B,QAAQ,GAAG,iBAAiB,CAC7B;IACC,eAAe,CAAC,EAAE,oBAAoB,CAAA;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,SAAS,CAAA;CACpB;AAED,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CA4GxC,CAAA"}
+{"version":3,"file":"ServerRouter.d.ts","sourceRoot":"","sources":["../../src/rsc/ServerRouter.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,OAAO,CAAA;AACpD,OAAO,KAAK,MAAM,OAAO,CAAA;AAQzB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;AAGtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAKtD,MAAM,WAAW,WAAY,SAAQ,IAAI,CACvC,0BAA0B,EAC1B,QAAQ,GAAG,iBAAiB,CAC7B;IACC,eAAe,CAAC,EAAE,oBAAoB,CAAA;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,SAAS,CAAA;CACpB;AAED,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAqHxC,CAAA"}

package/dist/rsc/ServerRouter.js

@@ -7,7 +7,14 @@ import { wrapWithSetWrappers } from "../Set.js";
 import { SplashPage } from "../splash-page.js";
 import { matchPath, parseSearch, replaceParams, validatePath } from "../util.js";
 import { ServerRouteLoader } from "./ServerRouteLoader.js";
-const Router = ({ paramTypes, children }) => {
+const Router = ({
+  paramTypes,
+  tenancy,
+  children
+}) => {
+  if (tenancy) {
+    throw new Error("`tenancy` is not supported with RSC yet");
+  }
   const location = getLocation();
   console.log("ServerRouter.tsx location", location);
   const analyzedRoutes = analyzeRoutes(children, {
@@ -98,12 +105,16 @@ const AuthenticatedRoute = ({
   children,
   roles,
   userRoles,
-  orgRoles
+  orgRoles,
+  orgPermission
 }) => {
   const { isAuthenticated } = getAuthState();
   if (orgRoles !== void 0) {
     throw new Error("`orgRoles` is not supported with RSC yet");
   }
+  if (orgPermission !== void 0) {
+    throw new Error("`orgPermission` is not supported with RSC yet");
+  }
   const isAuthorized = isAuthenticated && (!roles || hasRole(roles)) && (!userRoles || hasRole(userRoles));
   if (isAuthorized) {
     return /* @__PURE__ */ React.createElement(React.Fragment, null, children);
@@ -133,6 +144,7 @@ const WrappedPage = ({ routeLoaderElement, sets }) => {
           roles: set.props.roles,
           userRoles: set.props.userRoles,
           orgRoles: set.props.orgRoles,
+          orgPermission: set.props.orgPermission,
           whileLoadingAuth: set.props.whileLoadingAuth
         },
         wrapped

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/router",
-  "version": "8.0.0-canary.3542",
+  "version": "8.0.0-canary.3545",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -52,15 +52,15 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/project-config": "8.0.0-canary.3542",
-    "@cedarjs/server-store": "8.0.0-canary.3542",
+    "@cedarjs/project-config": "8.0.0-canary.3545",
+    "@cedarjs/server-store": "8.0.0-canary.3545",
     "react-server-dom-webpack": "19.3.1",
     "ts-toolbelt": "9.6.0"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
-    "@cedarjs/auth": "8.0.0-canary.3542",
-    "@cedarjs/framework-tools": "8.0.0-canary.3542",
+    "@cedarjs/auth": "8.0.0-canary.3545",
+    "@cedarjs/framework-tools": "8.0.0-canary.3545",
     "@testing-library/jest-dom": "6.9.1",
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",
@@ -74,7 +74,7 @@
     "vitest": "4.1.12"
   },
   "peerDependencies": {
-    "@cedarjs/auth": "8.0.0-canary.3542",
+    "@cedarjs/auth": "8.0.0-canary.3545",
     "react": "19.3.1",
     "react-dom": "19.3.1"
   },