@cedarjs/router 8.0.0-canary.3569 → 8.0.0-canary.3571

package/dist/AuthenticatedRoute.d.ts

@@ -2,7 +2,7 @@ import React from 'react';
 interface AuthenticatedRouteProps {
     children: React.ReactNode;
     roles?: string | string[];
-    orgPermission?: string;
+    permission?: string;
     unauthenticated: string;
     unauthorized?: string;
     whileLoadingAuth?: () => React.ReactElement | null;

package/dist/AuthenticatedRoute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticatedRoute.d.ts","sourceRoot":"","sources":["../src/AuthenticatedRoute.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAoC,MAAM,OAAO,CAAA;AAQxD,UAAU,uBAAuB;IAC/B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,MAAM,KAAK,CAAC,YAAY,GAAG,IAAI,CAAA;CACnD;AA6ED,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAwIhE,CAAA"}
+{"version":3,"file":"AuthenticatedRoute.d.ts","sourceRoot":"","sources":["../src/AuthenticatedRoute.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAoC,MAAM,OAAO,CAAA;AAQxD,UAAU,uBAAuB;IAC/B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,MAAM,KAAK,CAAC,YAAY,GAAG,IAAI,CAAA;CACnD;AA6ED,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CA2IhE,CAAA"}

package/dist/AuthenticatedRoute.js

@@ -45,7 +45,7 @@ const AuthenticatedRoute = ({
   unauthenticated,
   unauthorized,
   roles,
-  orgPermission,
+  permission,
   whileLoadingAuth,
   children
 }) => {
@@ -54,34 +54,34 @@ const AuthenticatedRoute = ({
   const {
     loading: authLoading,
     isAuthenticated,
-    hasRole
+    hasRole,
+    hasPermission
   } = routerState.useAuth();
   const { pathname } = useLocation();
   const pathParams = currentPathParams(routerState, pathname);
   const { tenancy } = routerState;
   const useOrg = tenancy?.useOrg ?? useNoOrg;
   const org = useOrg(routerState.useAuth, pathParams);
-  const needsOrg = orgPermission !== void 0;
+  const needsOrg = permission !== void 0 && !!tenancy;
   if (needsOrg && !org) {
-    if (!tenancy) {
-      throw new Error(
-        "A PrivateSet with `orgPermission` needs `tenancy` on the Router to find the organization with. Please pass `tenancy` from `@cedarjs/tenancy/web`: <Router useAuth={useAuth} tenancy={tenancy}>"
-      );
-    }
     if (authLoading) {
       return whileLoadingAuth?.() || null;
     }
     if (pathParams["orgSlug"] === void 0) {
       throw new Error(
-        "A PrivateSet with `orgPermission` needs an organization to check it in, and the route has no `orgSlug` param. Please only use `orgPermission` on routes with `{orgSlug}` in their path, or pass `createTenancy` a `useOrg` that finds the organization another way"
+        "A PrivateSet with `permission` needs an organization to check it in, and the route has no `orgSlug` param. Please only use `permission` on routes with `{orgSlug}` in their path, or pass `createTenancy` a `useOrg` that finds the organization another way"
       );
     }
     throw new Error(
-      "A PrivateSet with `orgPermission` got no organization from the Router's `tenancy` for this route, so there is nothing to check it in"
+      "A PrivateSet with `permission` got no organization from the Router's `tenancy` for this route, so there is nothing to check it in"
     );
   }
+  const auth = {
+    hasPermission
+  };
   const hasRequiredRoles = !roles || hasRole(roles);
-  if (isAuthenticated && hasRequiredRoles) {
+  const hasRequiredPermission = !!tenancy || permission === void 0 || auth.hasPermission(permission);
+  if (isAuthenticated && hasRequiredRoles && hasRequiredPermission) {
     if (!tenancy || !org) {
       return /* @__PURE__ */ React.createElement(React.Fragment, null, children);
     }
@@ -92,7 +92,7 @@ const AuthenticatedRoute = ({
       }
       return /* @__PURE__ */ React.createElement(React.Fragment, null, tenancy.notAMember ?? null);
     }
-    const hasRequiredOrgAccess = orgPermission === void 0 || (membership.permissions?.includes(orgPermission) ?? false);
+    const hasRequiredOrgAccess = permission === void 0 || (membership.permissions?.includes(permission) ?? false);
     if (hasRequiredOrgAccess) {
       if (mountedOrgId === membership.organizationId) {
         return /* @__PURE__ */ React.createElement(React.Fragment, null, children);

package/dist/Set.d.ts

@@ -1,6 +1,6 @@
 import type { ComponentType, ReactElement, ReactNode } from 'react';
 import React from 'react';
-import type { AuthTenancy, PermissionName } from '@cedarjs/auth' with {
+import type { PermissionName } from '@cedarjs/auth' with {
     'resolution-mode': 'import'
 };
 /**
@@ -25,34 +25,26 @@ export interface WrapperProps {
  *   <Set wrap={PostsScaffoldLayout}>
  */
 export type WrapperType = ComponentType<WrapperProps>;
-/**
- * `orgPermission`, only in an app with tenancy (see `AuthTenancy`)
- */
-type SetOrgPermission = AuthTenancy extends {
-    enabled: true;
-} ? {
-    /**
-     * Route is permitted when authenticated and the user's membership in
-     * the current organization has this permission (see
-     * `createPermissions` in `@cedarjs/tenancy`). With `roles` as well,
-     * they need both.
-     *
-     * The organization is the one the Router's `tenancy` finds for the
-     * route, by default the one with the route's `orgSlug` param:
-     *
-     *   <Router useAuth={useAuth} tenancy={tenancy}>
-     *
-     * A `PrivateSet` with `orgPermission` throws without `tenancy` on the
-     * router, or on a route that isn't in an organization.
-     */
-    orgPermission?: PermissionName;
-} : Record<never, never>;
-interface SetProps extends SetOrgPermission {
+interface SetProps {
     /**
      * Route is permitted when authenticated and user has any of the provided
      * roles such as "admin" or ["admin", "editor"], in `currentUser.roles`
      */
     roles?: string | string[];
+    /**
+     * Route is permitted when authenticated and the user has this permission
+     * (see `cedar setup permissions`). With `roles` as well, they need both.
+     *
+     * Without tenancy, it's one of the user's own permissions, in
+     * `currentUser.permissions`.
+     *
+     * With `tenancy` on the Router, it's a permission of the user's membership
+     * in the route's organization: the one the Router's `tenancy` finds, by
+     * default the one with the route's `orgSlug` param. A signed-in user who
+     * isn't a member gets the tenancy's `notAMember`. A `PrivateSet` with
+     * `permission` throws on a route that isn't in an organization.
+     */
+    permission?: PermissionName;
     /**
      * Components to wrap all routes in this set with, like layouts. The first
      * one in an array is the outermost one.
@@ -106,8 +98,8 @@ type PrivateSetProps = Omit<SetProps, 'private' | 'unauthenticated' | 'unauthori
     unauthenticated: string;
     /**
      * The page name where a user will be redirected when authenticated but
-     * without the required roles. Without it, they're redirected to
-     * `unauthenticated`.
+     * without the required roles or permission. Without it, they're
+     * redirected to `unauthenticated`.
      */
     unauthorized?: string;
 };

package/dist/Set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Set.d.ts","sourceRoot":"","sources":["../src/Set.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACnE,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;IAC/D,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,SAAS,CAAA;CACpB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;AAErD;;GAEG;AACH,KAAK,gBAAgB,GAAG,WAAW,SAAS;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACzD;IACE;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,cAAc,CAAA;CAC/B,GACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAExB,UAAU,QAAS,SAAQ,gBAAgB;IACzC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,WAAW,GAAG,SAAS,WAAW,EAAE,CAAA;IAC3C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;IAC5C,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,qBAIlC;AAED,KAAK,eAAe,GAAG,IAAI,CACzB,QAAQ,EACR,SAAS,GAAG,iBAAiB,GAAG,cAAc,CAC/C,GAAG;IACF;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,oDAAoD;AACpD,wBAAgB,OAAO,CAAC,KAAK,EAAE,eAAe,qBAI7C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,qBAIhD;AAED,eAAO,MAAM,SAAS,GAAI,MAAM,SAAS,KAAG,IAAI,IAAI,YAAY,CAAC,QAAQ,CAOxE,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC3B,MAAM,SAAS,KACd,IAAI,IAAI,YAAY,CAAC,eAAe,CAEtC,CAAA;AAGD,eAAO,MAAM,aAAa,GACxB,MAAM,SAAS,KACd,IAAI,IAAI,YAAY,CAAC,eAAe,CAEtC,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,SAAS,aAKpB"}
+{"version":3,"file":"Set.d.ts","sourceRoot":"","sources":["../src/Set.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACnE,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;IAClD,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,SAAS,CAAA;CACpB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;AAErD,UAAU,QAAQ;IAChB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,WAAW,GAAG,SAAS,WAAW,EAAE,CAAA;IAC3C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;IAC5C,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,qBAIlC;AAED,KAAK,eAAe,GAAG,IAAI,CACzB,QAAQ,EACR,SAAS,GAAG,iBAAiB,GAAG,cAAc,CAC/C,GAAG;IACF;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,oDAAoD;AACpD,wBAAgB,OAAO,CAAC,KAAK,EAAE,eAAe,qBAI7C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,qBAIhD;AAED,eAAO,MAAM,SAAS,GAAI,MAAM,SAAS,KAAG,IAAI,IAAI,YAAY,CAAC,QAAQ,CAOxE,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC3B,MAAM,SAAS,KACd,IAAI,IAAI,YAAY,CAAC,eAAe,CAEtC,CAAA;AAGD,eAAO,MAAM,aAAa,GACxB,MAAM,SAAS,KACd,IAAI,IAAI,YAAY,CAAC,eAAe,CAEtC,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,SAAS,aAKpB"}

package/dist/analyzeRoutes.d.ts

@@ -16,7 +16,7 @@ interface SetRenderProps {
     unauthenticated?: string;
     unauthorized?: string;
     roles?: string | string[];
-    orgPermission?: string;
+    permission?: string;
     whileLoadingAuth?: () => ReactElement | null;
 }
 interface Set {

package/dist/analyzeRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzeRoutes.d.ts","sourceRoot":"","sources":["../src/analyzeRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAGpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAQzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,WAAW,CAAA;AAElB,KAAK,gBAAgB,GAAG,MAAM,YAAY,GAAG,IAAI,CAAA;AAIjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,CACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,KACtD,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG,SAAS,WAAW,EAAE,CAAA;AAE7C;;;GAGG;AACH,UAAU,cAAc;IACtB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAEzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;CAC7C;AAED,UAAU,GAAG;IACX,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,cAAc,CAAA;CACtB;AA+CD,KAAK,SAAS,GAAG,MAAM,CAAA;AAEvB;;;;GAIG;AACH,UAAU,aAAa;IACrB,IAAI,EAAE,SAAS,CAAA;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAA;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,IAAI,EAAE,GAAG,EAAE,CAAA;CACZ;AAED,UAAU,oBAAoB;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;CAC3C;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,SAAS,EACnB,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,oBAAoB;;;;;;EAqK1D"}
+{"version":3,"file":"analyzeRoutes.d.ts","sourceRoot":"","sources":["../src/analyzeRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAGpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAQzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,WAAW,CAAA;AAElB,KAAK,gBAAgB,GAAG,MAAM,YAAY,GAAG,IAAI,CAAA;AAIjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,CACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,KACtD,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG,SAAS,WAAW,EAAE,CAAA;AAE7C;;;GAGG;AACH,UAAU,cAAc;IACtB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAA;CAC7C;AAED,UAAU,GAAG;IACX,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,cAAc,CAAA;CACtB;AA+CD,KAAK,SAAS,GAAG,MAAM,CAAA;AAEvB;;;;GAIG;AACH,UAAU,aAAa;IACrB,IAAI,EAAE,SAAS,CAAA;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAA;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,IAAI,EAAE,GAAG,EAAE,CAAA;CACZ;AAED,UAAU,oBAAoB;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;CAC3C;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,SAAS,EACnB,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,oBAAoB;;;;;;EAqK1D"}

package/dist/analyzeRoutes.js

@@ -25,8 +25,8 @@ function pickSetRenderProps(props) {
   if (props.roles !== void 0) {
     picked.roles = props.roles;
   }
-  if (props.orgPermission !== void 0) {
-    picked.orgPermission = props.orgPermission;
+  if (props.permission !== void 0) {
+    picked.permission = props.permission;
   }
   if (props.whileLoadingAuth !== void 0) {
     picked.whileLoadingAuth = props.whileLoadingAuth;

package/dist/router-context.d.ts

@@ -15,7 +15,7 @@ export interface RouterMembership {
     organizationId: string;
     /** The user's role in the organization, passed on to the `OrgProvider` */
     role: string;
-    /** What the membership may do, for `<PrivateSet orgPermission>` */
+    /** What the membership may do, for `<PrivateSet permission>` */
     permissions?: readonly string[] | undefined;
 }
 /**
@@ -35,9 +35,9 @@ export interface RouterOrg {
  *
  * One of the app's own can answer in three ways:
  * - an organization, with the user's membership in it or `null` for none.
- *   A set with `orgPermission` denies a user with no
+ *   A set with `permission` denies a user with no
  *   membership, and the router renders the tenancy's `notAMember`.
- * - `null`, for no organization: a set with `orgPermission` then
+ * - `null`, for no organization: a set with `permission` then
  *   throws the router's own error.
  * - throw an error of its own, such as for an organization that's been
  *   suspended. It reaches the app's error boundary like any error thrown
@@ -55,7 +55,7 @@ export interface OrgProviderProps {
  * How the router handles organizations. `createTenancy` from
  * `@cedarjs/tenancy/web` makes one. The router renders its `OrgProvider`
  * around the layouts and page of a `PrivateSet` whose route is in an
- * organization, and checks `orgPermission` against the
+ * organization, and checks a set's `permission` against the
  * membership its `useOrg` finds.
  */
 export interface Tenancy {

package/dist/router-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router-context.d.ts","sourceRoot":"","sources":["../src/router-context.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA6C,MAAM,OAAO,CAAA;AAEjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;IACxD,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAGD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAE1C,MAAM,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAC9C,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,CACR,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAA;IACZ,mEAAmE;IACnE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAC5C;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;CACzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,MAAM,GAAG,CACnB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,SAAS,GAAG,IAAI,CAAA;AAErB,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACxC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAA;IAClD,mFAAmF;IACnF,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAA;IACxC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;CAC5C;AAID,MAAM,WAAW,0BAA2B,SAAQ,IAAI,CACtD,WAAW,EACX,SAAS,CACV;IACC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAA;IACxC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;IAC3C,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAwBtE,CAAA;AAED,eAAO,MAAM,cAAc,mBAU1B,CAAA"}
+{"version":3,"file":"router-context.d.ts","sourceRoot":"","sources":["../src/router-context.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA6C,MAAM,OAAO,CAAA;AAEjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;IACxD,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAGD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAE1C,MAAM,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAC9C,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,CACR,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAA;IACZ,gEAAgE;IAChE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAC5C;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;CACzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,MAAM,GAAG,CACnB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,SAAS,GAAG,IAAI,CAAA;AAErB,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACxC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAA;IAClD,mFAAmF;IACnF,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAA;IACxC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;CAC5C;AAID,MAAM,WAAW,0BAA2B,SAAQ,IAAI,CACtD,WAAW,EACX,SAAS,CACV;IACC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAA;IACxC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;IAC3C,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,EAAE,CAAC,0BAA0B,CAwBtE,CAAA;AAED,eAAO,MAAM,cAAc,mBAU1B,CAAA"}

package/dist/router.d.ts

@@ -6,15 +6,14 @@ import type { AuthTenancy } from '@cedarjs/auth' with {
 import type { RouterContextProviderProps, Tenancy } from './router-context.js';
 import type { TrailingSlashesTypes } from './util.js';
 /**
- * `tenancy`, only in an app with tenancy (see `AuthTenancy`), where sets have
- * `orgPermission`
+ * `tenancy`, only in an app with tenancy (see `AuthTenancy`)
  */
 type RouterTenancy = AuthTenancy extends {
     enabled: true;
 } ? {
     /**
      * How the router handles organizations: finding the one of the current
-     * route, checking `orgPermission` in it, and providing
+     * route, checking a set's `permission` in it, and providing
      * it to the layouts and page of a `PrivateSet`. Pass the `tenancy` from
      * `createTenancy` in `@cedarjs/tenancy/web`:
      *

package/dist/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,OAAO,CAAA;AACpD,OAAO,KAAwB,MAAM,OAAO,CAAA;AAE5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;IAC/C,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAYD,OAAO,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAK9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAErD;;;GAGG;AACH,KAAK,aAAa,GAAG,WAAW,SAAS;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACtD;IACE;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,GACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAExB,MAAM,WAAW,WACf,SACE,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,iBAAiB,GAAG,SAAS,CAAC,EAC1E,aAAa;IACf,eAAe,CAAC,EAAE,oBAAoB,CAAA;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,SAAS,CAAA;CACpB;AAsCD,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAAwB,CAAA"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,OAAO,CAAA;AACpD,OAAO,KAAwB,MAAM,OAAO,CAAA;AAE5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;IAC/C,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AAYD,OAAO,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAK9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAErD;;GAEG;AACH,KAAK,aAAa,GAAG,WAAW,SAAS;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACtD;IACE;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,GACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAExB,MAAM,WAAW,WACf,SACE,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,iBAAiB,GAAG,SAAS,CAAC,EAC1E,aAAa;IACf,eAAe,CAAC,EAAE,oBAAoB,CAAA;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,SAAS,CAAA;CACpB;AAsCD,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAAwB,CAAA"}

package/dist/router.js

@@ -163,7 +163,7 @@ const WrappedPage = memo(({ sets, children }) => {
           unauthenticated,
           unauthorized: set.props.unauthorized,
           roles: set.props.roles,
-          orgPermission: set.props.orgPermission,
+          permission: set.props.permission,
           whileLoadingAuth: set.props.whileLoadingAuth
         },
         wrapped

package/dist/rsc/ClientRouter.js

@@ -33,11 +33,6 @@ const LocationAwareRouter = ({
     return /* @__PURE__ */ React.createElement(RscRoutes, { pathname, search });
   }
   const requestedRoute = pathRouteMap[activeRoutePath];
-  for (const set of requestedRoute.sets) {
-    if (set.props.orgPermission !== void 0) {
-      throw new Error("`orgPermission` is not supported with RSC yet");
-    }
-  }
   const reversedSets = requestedRoute.sets.toReversed();
   const privateSet = reversedSets.find((set) => set.isPrivate);
   if (privateSet) {

package/dist/rsc/ServerRouter.js

@@ -101,16 +101,18 @@ function hasRole(requiredRoles) {
   const requiredRolesArray = Array.isArray(requiredRoles) ? requiredRoles : [requiredRoles];
   return requiredRolesArray.some((role) => roles.includes(role));
 }
+function hasPermission(permission) {
+  const { currentUser } = getAuthState();
+  const permissions = currentUser && typeof currentUser === "object" && "permissions" in currentUser ? currentUser.permissions : void 0;
+  return Array.isArray(permissions) && permissions.includes(permission);
+}
 const AuthenticatedRoute = ({
   children,
   roles,
-  orgPermission
+  permission
 }) => {
   const { isAuthenticated } = getAuthState();
-  if (orgPermission !== void 0) {
-    throw new Error("`orgPermission` is not supported with RSC yet");
-  }
-  const isAuthorized = isAuthenticated && (!roles || hasRole(roles));
+  const isAuthorized = isAuthenticated && (!roles || hasRole(roles)) && (permission === void 0 || hasPermission(permission));
   if (isAuthorized) {
     return /* @__PURE__ */ React.createElement(React.Fragment, null, children);
   }
@@ -137,7 +139,7 @@ const WrappedPage = ({ routeLoaderElement, sets }) => {
         {
           unauthenticated,
           roles: set.props.roles,
-          orgPermission: set.props.orgPermission,
+          permission: set.props.permission,
           whileLoadingAuth: set.props.whileLoadingAuth
         },
         wrapped

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/router",
-  "version": "8.0.0-canary.3569",
+  "version": "8.0.0-canary.3571",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -52,15 +52,15 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/project-config": "8.0.0-canary.3569",
-    "@cedarjs/server-store": "8.0.0-canary.3569",
+    "@cedarjs/project-config": "8.0.0-canary.3571",
+    "@cedarjs/server-store": "8.0.0-canary.3571",
     "react-server-dom-webpack": "19.3.1",
     "ts-toolbelt": "9.6.0"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
-    "@cedarjs/auth": "8.0.0-canary.3569",
-    "@cedarjs/framework-tools": "8.0.0-canary.3569",
+    "@cedarjs/auth": "8.0.0-canary.3571",
+    "@cedarjs/framework-tools": "8.0.0-canary.3571",
     "@testing-library/jest-dom": "6.9.1",
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",
@@ -74,7 +74,7 @@
     "vitest": "4.1.12"
   },
   "peerDependencies": {
-    "@cedarjs/auth": "8.0.0-canary.3569",
+    "@cedarjs/auth": "8.0.0-canary.3571",
     "react": "19.3.1",
     "react-dom": "19.3.1"
   },