@cedarjs/tenancy 8.0.0-canary.3541 → 8.0.0-canary.3542

package/README.md

@@ -135,12 +135,29 @@ rather than an organization use `@requireUserAuth`.
 
 ## Web
 
-`@cedarjs/tenancy/web` exports `OrgScope`, `useCurrentOrg` and
+`@cedarjs/tenancy/web` exports `OrgScope`, `useCurrentOrg`, `useOrgRoles` and
 `getMemberships`/`hasOrgRole` for the client side: a per-organization Apollo
 client provided under organization routes, keyed by the immutable organization
 id so switching organizations never mixes caches. `useCurrentOrg().hasOrgRole`
-checks the user's role in the organization, and `OrgScope`'s `roles` and
-`unauthorized` props guard routes by it. `useAuth().hasUserRole` checks
-`currentUser.roles`; there's no `useAuth().hasRole` or `<PrivateSet roles>` in
-an app with tenancy. See the how-to for the full
-`<Set wrap={OrgScope}>` setup `yarn cedar setup tenancy` generates.
+checks the user's role in the organization. To guard routes by it, pass
+`useOrgRoles` to the router and give a `PrivateSet` `orgRoles` and
+`unauthorized`:
+
+<!-- prettier-ignore -->
+```tsx
+<Router useAuth={useAuth} useOrgRoles={useOrgRoles}>
+  <PrivateSet wrap={[OrgScope, OrgLayout]} unauthenticated="login">
+    <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
+  </PrivateSet>
+  <PrivateSet wrap={[OrgScope, OrgLayout]} unauthenticated="login" unauthorized="projects" orgRoles="owner">
+    <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
+  </PrivateSet>
+</Router>
+```
+
+The router checks the role in the organization of the route's `orgSlug` param,
+so a `PrivateSet` with `orgRoles` throws without `useOrgRoles` on the router or
+an `{orgSlug}` in the route's path. `useAuth().hasUserRole` and
+`<PrivateSet userRoles>` check `currentUser.roles`; there's no
+`useAuth().hasRole` or `<PrivateSet roles>` in an app with tenancy. See the
+how-to for the full setup `yarn cedar setup tenancy` generates.

package/dist/web/OrgScope.d.ts

@@ -7,8 +7,8 @@ export interface OrgScopeProps {
     notAMember?: React.ReactNode;
     /**
      * Only members with one of these roles in the organization get in.
-     * Checked after the organization is resolved, which `<PrivateSet roles>`
-     * around `OrgScope` can't do.
+     * Checked after the organization is resolved. For routes, prefer
+     * `<PrivateSet orgRoles>`.
      */
     roles?: string | string[];
     /**

package/dist/web/OrgScope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OrgScope.d.ts","sourceRoot":"","sources":["../../src/web/OrgScope.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAIzB,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAqB5D,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;IAC5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;IACrC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAwCD;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,EACvB,OAAO,EAAE,WAAW,EACpB,UAAiB,EACjB,KAAK,EACL,UAAU,EACV,YAAY,EACZ,OAAmB,EACnB,QAAQ,EACR,QAAQ,GACT,EAAE,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CA8KnC"}
+{"version":3,"file":"OrgScope.d.ts","sourceRoot":"","sources":["../../src/web/OrgScope.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAIzB,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAsB5D,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;IAC5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;IACrC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAwCD;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,EACvB,OAAO,EAAE,WAAW,EACpB,UAAiB,EACjB,KAAK,EACL,UAAU,EACV,YAAY,EACZ,OAAmB,EACnB,QAAQ,EACR,QAAQ,GACT,EAAE,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CA4KnC"}

package/dist/web/OrgScope.js

@@ -10,6 +10,7 @@ import {
   useParams
 } from "@cedarjs/router";
 import { useCreateApolloClient } from "@cedarjs/web/apollo";
+import { findMembership } from "./findMembership.js";
 import { getMemberships } from "./getMemberships.js";
 import { hasOrgRole } from "./hasOrgRole.js";
 import { clearOrgClients, dropOrgClient, getOrgClient } from "./orgClients.js";
@@ -70,9 +71,8 @@ function OrgScope({
     const nextMemberships = membershipRoleMap(memberships);
     let dropped = false;
     if (userId) {
-      for (const [organizationId, role] of lastMembershipsRef.current) {
-        const currentRole = nextMemberships.get(organizationId);
-        if (currentRole === void 0 || currentRole !== role) {
+      for (const organizationId of lastMembershipsRef.current.keys()) {
+        if (!nextMemberships.has(organizationId)) {
           void dropOrgClient(userId, organizationId);
           dropped = true;
         }
@@ -100,7 +100,7 @@ function OrgScope({
     },
     [onSetOrg, params, location.pathname, location.search, location.hash]
   );
-  const membership = orgSlug ? memberships.find((m) => m.organization.slug === orgSlug) : void 0;
+  const membership = findMembership(memberships, orgSlug);
   const membershipPermissions = membership?.permissions;
   const hasPermission = React.useCallback(
     (permissionToCheck) => membershipPermissions?.includes(permissionToCheck) ?? false,
@@ -131,6 +131,7 @@ function OrgScope({
   const orgClient = getOrgClient({
     userId,
     organizationId: membership.organizationId,
+    role: membership.role,
     createClient: () => createClient({
       headers: { [CEDAR_ORG_HEADER]: membership.organizationId }
     })

package/dist/web/findMembership.d.ts

@@ -0,0 +1,8 @@
+import type { OrgMembership } from './types.js';
+/**
+ * The membership in the organization whose slug is `orgSlug`, if the user
+ * has one. `OrgScope` and `useOrgRoles` both find the organization with it,
+ * so they agree on which one a route is in.
+ */
+export declare function findMembership(memberships: OrgMembership[], orgSlug: string | undefined): OrgMembership | undefined;
+//# sourceMappingURL=findMembership.d.ts.map

package/dist/web/findMembership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findMembership.d.ts","sourceRoot":"","sources":["../../src/web/findMembership.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,aAAa,EAAE,EAC5B,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,aAAa,GAAG,SAAS,CAM3B"}

package/dist/web/findMembership.js

@@ -0,0 +1,9 @@
+function findMembership(memberships, orgSlug) {
+  if (!orgSlug) {
+    return void 0;
+  }
+  return memberships.find((m) => m.organization.slug === orgSlug);
+}
+export {
+  findMembership
+};

package/dist/web/index.d.ts

@@ -5,4 +5,5 @@ export { OrgScope } from './OrgScope.js';
 export { clearOrgClients } from './orgClients.js';
 export type { CurrentOrgSummary, OrgContextValue, OrgMembership, } from './types.js';
 export { useCurrentOrg } from './useCurrentOrg.js';
+export { useOrgRoles } from './useOrgRoles.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/web/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/web/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/web/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/web/index.js

@@ -3,10 +3,12 @@ import { hasOrgRole } from "./hasOrgRole.js";
 import { OrgScope } from "./OrgScope.js";
 import { clearOrgClients } from "./orgClients.js";
 import { useCurrentOrg } from "./useCurrentOrg.js";
+import { useOrgRoles } from "./useOrgRoles.js";
 export {
   OrgScope,
   clearOrgClients,
   getMemberships,
   hasOrgRole,
-  useCurrentOrg
+  useCurrentOrg,
+  useOrgRoles
 };

package/dist/web/orgClients.d.ts

@@ -2,6 +2,12 @@ import type { ApolloClient } from '@apollo/client';
 export interface GetOrgClientOptions {
     userId: string;
     organizationId: string;
+    /**
+     * The user's role in the organization. A client cached for another role is
+     * replaced, so data cached under that role doesn't outlive it, whether or
+     * not an `OrgScope` was mounted to see the role change.
+     */
+    role: string;
     /** Builds a new client. Only called on a cache miss. */
     createClient: () => ApolloClient;
 }
@@ -10,11 +16,11 @@ export interface GetOrgClientOptions {
  * creating and caching it on first use so returning to an organization
  * reuses its client and cache.
  */
-export declare function getOrgClient({ userId, organizationId, createClient, }: GetOrgClientOptions): ApolloClient;
+export declare function getOrgClient({ userId, organizationId, role, createClient, }: GetOrgClientOptions): ApolloClient;
 /**
  * Drops one organization's client, clearing its cache first. Called when a
- * memberships refresh shows the membership gone or its role changed, so
- * data cached under the previous authorization does not outlive it.
+ * memberships refresh shows the membership gone, so data cached under it
+ * does not outlive it. (A role change is handled by `getOrgClient`.)
  */
 export declare function dropOrgClient(userId: string, organizationId: string): Promise<void>;
 /**

package/dist/web/orgClients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgClients.d.ts","sourceRoot":"","sources":["../../src/web/orgClients.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAgBlD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,wDAAwD;IACxD,YAAY,EAAE,MAAM,YAAY,CAAA;CACjC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,EAC3B,MAAM,EACN,cAAc,EACd,YAAY,GACb,EAAE,mBAAmB,GAAG,YAAY,CAYpC;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAKrD"}
+{"version":3,"file":"orgClients.d.ts","sourceRoot":"","sources":["../../src/web/orgClients.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAiBlD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,wDAAwD;IACxD,YAAY,EAAE,MAAM,YAAY,CAAA;CACjC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,EAC3B,MAAM,EACN,cAAc,EACd,IAAI,EACJ,YAAY,GACb,EAAE,mBAAmB,GAAG,YAAY,CAgBpC;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAKrD"}

package/dist/web/orgClients.js

@@ -5,30 +5,34 @@ function clientKey(userId, organizationId) {
 function getOrgClient({
   userId,
   organizationId,
+  role,
   createClient
 }) {
   const key = clientKey(userId, organizationId);
   const existing = clients.get(key);
+  if (existing?.role === role) {
+    return existing.client;
+  }
   if (existing) {
-    return existing;
+    void existing.client.clearStore();
   }
   const client = createClient();
-  clients.set(key, client);
+  clients.set(key, { client, role });
   return client;
 }
 async function dropOrgClient(userId, organizationId) {
   const key = clientKey(userId, organizationId);
-  const client = clients.get(key);
-  if (!client) {
+  const entry = clients.get(key);
+  if (!entry) {
     return;
   }
   clients.delete(key);
-  await client.clearStore();
+  await entry.client.clearStore();
 }
 async function clearOrgClients() {
   const clientsToClear = Array.from(clients.values());
   clients.clear();
-  await Promise.all(clientsToClear.map((client) => client.clearStore()));
+  await Promise.all(clientsToClear.map(({ client }) => client.clearStore()));
 }
 export {
   clearOrgClients,

package/dist/web/useOrgRoles.d.ts

@@ -0,0 +1,22 @@
+import type { UseAuth } from '@cedarjs/auth';
+/**
+ * Checks the user's role in the organization of the current route, for
+ * `<PrivateSet orgRoles>`. Pass it to the router, next to `useAuth`:
+ *
+ *   <Router useAuth={useAuth} useOrgRoles={useOrgRoles}>
+ *
+ * The router calls it with its `useAuth` and the current route's path
+ * params. It returns `null` when the route has no `orgSlug` param, so there's
+ * no organization to check a role in. Otherwise it returns a check of whether
+ * the user's role in the organization with that slug is one of `roles` (a
+ * role, or a list of roles): `false` when they aren't signed in or aren't a
+ * member of it.
+ *
+ * An app can pass the router a hook of its own instead, such as one that
+ * wraps this one with the organization from somewhere other than the path.
+ * Besides returning a check or `null`, it can throw an error of its own,
+ * which reaches the app's error boundary like any error thrown while
+ * rendering. See `UseOrgRoles` in `@cedarjs/router`.
+ */
+export declare function useOrgRoles(useAuth: UseAuth, params: Record<string, string>): ((roles: string | string[]) => boolean) | null;
+//# sourceMappingURL=useOrgRoles.d.ts.map

package/dist/web/useOrgRoles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useOrgRoles.d.ts","sourceRoot":"","sources":["../../src/web/useOrgRoles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAM5C;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,IAAI,CAehD"}

package/dist/web/useOrgRoles.js

@@ -0,0 +1,16 @@
+import { findMembership } from "./findMembership.js";
+import { getMemberships } from "./getMemberships.js";
+import { hasOrgRole } from "./hasOrgRole.js";
+function useOrgRoles(useAuth, params) {
+  const { isAuthenticated, currentUser } = useAuth();
+  const orgSlug = Object.hasOwn(params, "orgSlug") ? params["orgSlug"] : void 0;
+  if (orgSlug === void 0) {
+    return null;
+  }
+  const memberships = isAuthenticated ? getMemberships(currentUser) : [];
+  const membership = findMembership(memberships, orgSlug);
+  return (roles) => !!membership && hasOrgRole(memberships, roles, membership.organizationId);
+}
+export {
+  useOrgRoles
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/tenancy",
-  "version": "8.0.0-canary.3541",
+  "version": "8.0.0-canary.3542",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -44,17 +44,17 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/api": "8.0.0-canary.3541",
-    "@cedarjs/context": "8.0.0-canary.3541",
-    "@cedarjs/graphql-server": "8.0.0-canary.3541"
+    "@cedarjs/api": "8.0.0-canary.3542",
+    "@cedarjs/context": "8.0.0-canary.3542",
+    "@cedarjs/graphql-server": "8.0.0-canary.3542"
   },
   "devDependencies": {
     "@apollo/client": "4.3.5",
     "@arethetypeswrong/cli": "0.18.5",
-    "@cedarjs/auth": "8.0.0-canary.3541",
-    "@cedarjs/framework-tools": "8.0.0-canary.3541",
-    "@cedarjs/router": "8.0.0-canary.3541",
-    "@cedarjs/web": "8.0.0-canary.3541",
+    "@cedarjs/auth": "8.0.0-canary.3542",
+    "@cedarjs/framework-tools": "8.0.0-canary.3542",
+    "@cedarjs/router": "8.0.0-canary.3542",
+    "@cedarjs/web": "8.0.0-canary.3542",
     "@prisma/adapter-better-sqlite3": "7.10.1",
     "@prisma/client": "7.10.1",
     "@testing-library/dom": "10.4.2",
@@ -80,9 +80,9 @@
   },
   "peerDependencies": {
     "@apollo/client": "4.3.5",
-    "@cedarjs/auth": "8.0.0-canary.3541",
-    "@cedarjs/router": "8.0.0-canary.3541",
-    "@cedarjs/web": "8.0.0-canary.3541",
+    "@cedarjs/auth": "8.0.0-canary.3542",
+    "@cedarjs/router": "8.0.0-canary.3542",
+    "@cedarjs/web": "8.0.0-canary.3542",
     "@prisma/client": "7.10.1",
     "react": "19.3.1"
   },