@cedarjs/tenancy 8.0.0-canary.3565 → 8.0.0-canary.3568

package/README.md

@@ -73,44 +73,39 @@ import {
 - `getCurrentOrg()` / `requireCurrentOrg()` — read the organization set on the
   current request; the latter throws `TenantScopeError` when none is set.
 
-## Auth helpers
+## User checks
 
-```ts
-// api/src/lib/auth.ts, in place of the single-tenant hasRole/requireAuth
-import { createTenancyAuth } from '@cedarjs/tenancy'
-
-export const { hasUserRole, hasOrgRole, requireUserAuth, requireOrgAuth } =
-  createTenancyAuth()
-
-// In a service:
-requireOrgAuth({ roles: ['owner', 'admin'] }) // in the current organization
-requireUserAuth() // signed in, no organization needed
-
-// Anywhere:
-if (hasOrgRole('owner')) { ... } // in the current organization
-if (hasUserRole('superuser')) { ... } // currentUser.roles
-```
-
-`requireOrgAuth` (and the `@requireOrgAuth` directive `setup tenancy` adds) is
-about the current organization: it throws `AuthenticationError` with no
-current user, and `ForbiddenError` with no current organization or when the
-user's role there isn't one of `roles` when they're given. With no `roles`,
-any member gets in. `requireUserAuth` (and `@requireUserAuth`) is for fields about the user
-rather than an organization: it needs a signed-in user, and checks `roles`
-against `currentUser.roles`. `hasOrgRole` and `hasUserRole` are the boolean
-checks to match. There's no `requireAuth` or `hasRole`.
+`hasRole` and `requireAuth` in `api/src/lib/auth.ts`, and the `@requireAuth`
+directive, are for fields about the user rather than an organization: their
+account, their memberships, accepting an invitation. `requireAuth` needs a
+signed-in user, and both check `roles` against `currentUser.roles`: the user's own roles, in
+any organization or none. There's no role check on the current
+organization: fields about an organization ask for a permission (below).
 
 ## Permissions
 
+Roles in an organization are named bundles of permissions, defined in one
+place. Fields, services and components check a permission in an
+organization, never the membership's role, so a role can do exactly what its
+list says. `hasRole` and `<PrivateSet roles>` check the user's own roles, in
+`currentUser.roles`.
+
 ```ts
 // packages/permissions/src/index.ts, shared by the api and web sides
 import { definePermissions } from '@cedarjs/tenancy/permissions'
 
+const member = ['organization.read', 'projects.read'] as const
+
 export const permissions = definePermissions({
-  permissions: ['projects.read', 'projects.edit', 'members.manage'],
+  permissions: [
+    'organization.read',
+    'projects.read',
+    'projects.edit',
+    'members.manage',
+  ],
   roles: {
-    owner: ['projects.read', 'projects.edit', 'members.manage'],
-    member: ['projects.read'],
+    owner: [...member, 'projects.edit', 'members.manage'],
+    member,
   },
 })
 ```
@@ -121,28 +116,40 @@ import { createPermissions } from '@cedarjs/tenancy'
 
 import { permissions } from '@my-app/permissions'
 
-export const { hasPermission, requirePermission, withPermissions } =
-  createPermissions(permissions)
+export const {
+  hasPermission,
+  requirePermission,
+  canGrantRole,
+  withPermissions,
+} = createPermissions(permissions)
 ```
 
-Roles map to permissions in one place; fields ask for a permission with
-`@requirePermission(permission: "projects.edit")` or `requirePermission()`.
-A role only gets what its list says, so a new role is one entry. Permission
-names are typed from the definitions. `withPermissions` in `getCurrentUser` gives each
-membership its permissions, which `useAuth().hasPermission()` checks inside
-an organization route. Every permission is about an organization: fields about the user
-rather than an organization use `@requireUserAuth`.
+Fields ask for a permission with `@requirePermission(permission:
+"projects.edit")`, and services with `requirePermission('projects.edit')`.
+"Any member" is a permission every role lists, such as `organization.read`,
+so a new role starts with nothing until its entry says otherwise. Permission
+names are typed from the definitions, and an unknown name throws.
+
+`canGrantRole(role)` is whether the signed-in user may give someone `role`,
+or take it away: they hold every permission it has. Nobody can hand out more
+than they may do themselves, and a new role needs no grant table. It
+doesn't check `members.manage`: whoever calls it checks that first, as the
+generated `inviteMember` and `removeMember` do with
+`@requirePermission(permission: "members.manage")`.
+
+`withPermissions` in `getCurrentUser` gives each membership its permissions,
+which `useAuth().hasPermission()` checks inside an organization route.
 
 ## Web
 
 `@cedarjs/tenancy/web` exports `createTenancy`, a ready-made `tenancy`,
-`useCurrentOrg`, `useOrgBySlug` and `getMemberships`/`hasOrgRole` for the client
+`useCurrentOrg`, `useOrgBySlug` and `getMemberships` for the client
 side. Pass the tenancy to the router and put organization routes in a
 `PrivateSet`: the router renders a per-organization Apollo client, keyed by the
 immutable organization id so switching organizations never mixes caches, around
-the set's layouts and page. `useCurrentOrg().hasOrgRole` checks the user's role
-in the organization. To guard routes by it, give a `PrivateSet` `orgRoles` or
-`orgPermission`, and `unauthorized`:
+the set's layouts and page. `useAuth().hasPermission()` checks what the user
+may do in the organization. To guard routes by a permission of the user's
+membership, give a `PrivateSet` `orgPermission` and `unauthorized`:
 
 <!-- prettier-ignore -->
 ```tsx
@@ -152,9 +159,6 @@ import { tenancy } from 'src/tenancy'
   <PrivateSet wrap={OrgLayout} unauthenticated="login">
     <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
   </PrivateSet>
-  <PrivateSet wrap={OrgLayout} unauthenticated="login" unauthorized="projects" orgRoles="owner">
-    <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
-  </PrivateSet>
   <PrivateSet wrap={OrgLayout} unauthenticated="login" unauthorized="projects" orgPermission="members.manage">
     <Route path="/org/{orgSlug}/members" page={MembersPage} name="members" />
   </PrivateSet>
@@ -169,12 +173,13 @@ export const tenancy = createTenancy({
 })
 ```
 
-The router checks the role and permission in the organization of the route's
-`orgSlug` param. A `PrivateSet` with `orgRoles` or `orgPermission` throws when
+The router checks the permission in the organization that `tenancy.useOrg`
+returns. The default `useOrg` finds it by the route's `orgSlug` param, and a
+custom one can find it another way, such as from the host. A `PrivateSet` with `orgPermission` throws when
 the router has no `tenancy` or its `useOrg` finds no organization for the
 route; with the default lookup, that's a route without `{orgSlug}`. A route
 with `{orgSlug}` outside a `PrivateSet` is a public page with no organization
-context. `useAuth().hasUserRole` and `<PrivateSet userRoles>` check
-`currentUser.roles`; there's no `useAuth().hasRole` or `<PrivateSet roles>` in
-an app with tenancy. See the
+context. `useAuth().hasRole` and `<PrivateSet roles>` check
+`currentUser.roles`, the user's own roles, as in an app without tenancy;
+checks in an organization use a permission. See the
 how-to for the full setup `yarn cedar setup tenancy` generates.

package/dist/index.d.ts

@@ -1,6 +1,5 @@
 export * from './errors.js';
 export * from './context.js';
-export * from './auth.js';
 export * from './permissions.js';
 export { createTenancyExtension } from './prismaExtension.js';
 export type { ModelNamesFor, TenancyConfig, UnscopedClient, } from './prismaExtension.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,YAAY,EACV,aAAa,EACb,aAAa,EACb,cAAc,GACf,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,YAAY,EACV,aAAa,EACb,aAAa,EACb,cAAc,GACf,MAAM,sBAAsB,CAAA"}

package/dist/index.js

@@ -1,6 +1,5 @@
 export * from "./errors.js";
 export * from "./context.js";
-export * from "./auth.js";
 export * from "./permissions.js";
 import { createTenancyExtension } from "./prismaExtension.js";
 export {

package/dist/permissions.d.ts

@@ -21,9 +21,17 @@ export interface Permissions<Permission extends string> {
      * `AuthenticationError` when no one is signed in, and `ForbiddenError`
      * when they may not.
      */
-    requirePermission(options: {
-        permission: Permission;
-    }): void;
+    requirePermission(permission: Permission): void;
+    /**
+     * Whether the signed-in user may give `role` to someone in the current
+     * organization, or take it away: they hold every permission `role` has,
+     * so no one can hand out more than they may do themselves. False for a
+     * role the definitions don't list.
+     *
+     * This is only the role half: who may manage members at all is a
+     * permission of its own (`members.manage`, say) on the field.
+     */
+    canGrantRole(role: string): boolean;
     /**
      * What a membership may do: its role's permissions. The one place a membership's permissions are worked out, which
      * `hasPermission`, `requirePermission` and `withPermissions` all use.
@@ -55,7 +63,7 @@ export interface Permissions<Permission extends string> {
  * // api/src/lib/permissions.ts
  * import { permissions } from '@my-app/permissions'
  *
- * export const { hasPermission, requirePermission, withPermissions } =
+ * export const { hasPermission, requirePermission, canGrantRole, withPermissions } =
  *   createPermissions(permissions)
  * ```
  *

package/dist/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAEnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,YAAY,EACV,qBAAqB,EACrB,cAAc,GACf,MAAM,wBAAwB,CAAA;AAE/B,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wEAAwE;AACxE,MAAM,MAAM,eAAe,CACzB,UAAU,EACV,UAAU,SAAS,MAAM,IACvB,UAAU,GAAG;IAAE,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,CAAA;AAE9C,MAAM,WAAW,WAAW,CAAC,UAAU,SAAS,MAAM;IACpD;;;;OAIG;IACH,aAAa,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAA;IAC9C;;;;OAIG;IACH,iBAAiB,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,wBAAwB,GAAG,UAAU,EAAE,CAAA;IACjE;;;;OAIG;IACH,eAAe,CAAC,IAAI,SAAS;QAAE,WAAW,EAAE,wBAAwB,EAAE,CAAA;KAAE,EACtE,IAAI,EAAE,IAAI,GACT,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG;QAC7B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAA;KACxE,CAAA;IACD,eAAe,CAAC,IAAI,SAAS;QAAE,WAAW,EAAE,wBAAwB,EAAE,CAAA;KAAE,EACtE,IAAI,EAAE,IAAI,GAAG,IAAI,GAEf,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG;QAC3B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAA;KACxE,CAAC,GACF,IAAI,CAAA;CACT;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,UAAU,SAAS,MAAM,EAC/D,WAAW,EAAE,qBAAqB,CAAC,UAAU,CAAC,GAC7C,WAAW,CAAC,UAAU,CAAC,CAwFzB"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAEnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,YAAY,EACV,qBAAqB,EACrB,cAAc,GACf,MAAM,wBAAwB,CAAA;AAE/B,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wEAAwE;AACxE,MAAM,MAAM,eAAe,CACzB,UAAU,EACV,UAAU,SAAS,MAAM,IACvB,UAAU,GAAG;IAAE,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,CAAA;AAE9C,MAAM,WAAW,WAAW,CAAC,UAAU,SAAS,MAAM;IACpD;;;;OAIG;IACH,aAAa,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAA;IAC9C;;;;OAIG;IACH,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAA;IAC/C;;;;;;;;OAQG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IACnC;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,wBAAwB,GAAG,UAAU,EAAE,CAAA;IACjE;;;;OAIG;IACH,eAAe,CAAC,IAAI,SAAS;QAAE,WAAW,EAAE,wBAAwB,EAAE,CAAA;KAAE,EACtE,IAAI,EAAE,IAAI,GACT,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG;QAC7B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAA;KACxE,CAAA;IACD,eAAe,CAAC,IAAI,SAAS;QAAE,WAAW,EAAE,wBAAwB,EAAE,CAAA;KAAE,EACtE,IAAI,EAAE,IAAI,GAAG,IAAI,GAEf,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG;QAC3B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAA;KACxE,CAAC,GACF,IAAI,CAAA;CACT;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,UAAU,SAAS,MAAM,EAC/D,WAAW,EAAE,qBAAqB,CAAC,UAAU,CAAC,GAC7C,WAAW,CAAC,UAAU,CAAC,CAqGzB"}

package/dist/permissions.js

@@ -46,7 +46,17 @@ function createPermissions(definitions) {
     hasPermission,
     permissionsOf,
     withPermissions,
-    requirePermission({ permission }) {
+    canGrantRole(role) {
+      const membership = context.currentUser ? currentMembership() : void 0;
+      if (!membership || !Object.hasOwn(definitions.roles, role)) {
+        return false;
+      }
+      const held = permissionsOf(membership);
+      return definitions.roles[role].every(
+        (permission) => held.includes(permission)
+      );
+    },
+    requirePermission(permission) {
       assertDefined(permission);
       if (!context.currentUser) {
         throw new AuthenticationError("You don't have permission to do that.");

package/dist/web/createTenancy.d.ts

@@ -36,8 +36,7 @@ export interface CreateTenancyOptions {
  * Makes the `tenancy` to pass to the `Router`. The router then renders the
  * organization's provider itself, around the layouts and page of every
  * `PrivateSet` whose route is in an organization (by default, one with
- * `{orgSlug}` in its path), and checks `orgRoles` and `orgPermission` on
- * those sets.
+ * `{orgSlug}` in its path), and checks `orgPermission` on those sets.
  *
  * Call it once, at the top level of a module, like `web/src/tenancy.tsx`:
  * a new tenancy on each render would remount the provider.

package/dist/web/createTenancy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createTenancy.d.ts","sourceRoot":"","sources":["../../src/web/createTenancy.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAMzB,OAAO,KAAK,EAAoB,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AASxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAOlD;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,SAAS,GAAG,IAAI,CAAA;AAErB,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;CACtC;AAiJD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAwBzE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,SAAkB,CAAA"}
+{"version":3,"file":"createTenancy.d.ts","sourceRoot":"","sources":["../../src/web/createTenancy.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAMzB,OAAO,KAAK,EAAoB,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAQxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAOlD;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,SAAS,GAAG,IAAI,CAAA;AAErB,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;CACtC;AA+ID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAwBzE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,SAAkB,CAAA"}

package/dist/web/createTenancy.js

@@ -5,7 +5,6 @@ import { HasPermissionContext } from "@cedarjs/auth";
 import { navigate, useLocation, useParams } from "@cedarjs/router";
 import { useCreateApolloClient } from "@cedarjs/web/apollo";
 import { isOrgMembership } from "./getMemberships.js";
-import { hasOrgRole } from "./hasOrgRole.js";
 import { getOrgClient } from "./orgClients.js";
 import { OrgContext } from "./OrgContext.js";
 import { useOrgBySlug } from "./useOrgBySlug.js";
@@ -88,7 +87,6 @@ function OrgProviderImplementation({
   const contextValue = {
     org,
     memberships,
-    hasOrgRole: (roles, organizationId) => hasOrgRole(memberships, roles, organizationId ?? org.id),
     setOrg
   };
   return /* @__PURE__ */ jsx(ApolloProvider, { client: orgClient, children: /* @__PURE__ */ jsx(OrgContext.Provider, { value: contextValue, children: /* @__PURE__ */ jsx(HasPermissionContext.Provider, { value: hasPermission, children }) }) });

package/dist/web/index.d.ts

@@ -1,7 +1,6 @@
 export type { CreateTenancyOptions, UseTenancyOrg } from './createTenancy.js';
 export { createTenancy, tenancy } from './createTenancy.js';
 export { getMemberships } from './getMemberships.js';
-export { hasOrgRole } from './hasOrgRole.js';
 export { clearOrgClients } from './orgClients.js';
 export type { CurrentOrgSummary, OrgContextValue, OrgMembership, } from './types.js';
 export { useCurrentOrg } from './useCurrentOrg.js';

package/dist/web/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/web/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/web/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/web/index.js

@@ -1,6 +1,5 @@
 import { createTenancy, tenancy } from "./createTenancy.js";
 import { getMemberships } from "./getMemberships.js";
-import { hasOrgRole } from "./hasOrgRole.js";
 import { clearOrgClients } from "./orgClients.js";
 import { useCurrentOrg } from "./useCurrentOrg.js";
 import { useOrgBySlug } from "./useOrgBySlug.js";
@@ -8,7 +7,6 @@ export {
   clearOrgClients,
   createTenancy,
   getMemberships,
-  hasOrgRole,
   tenancy,
   useCurrentOrg,
   useOrgBySlug

package/dist/web/types.d.ts

@@ -38,7 +38,6 @@ export interface CurrentOrgSummary {
 export interface OrgContextValue {
     org: CurrentOrgSummary | undefined;
     memberships: OrgMembership[];
-    hasOrgRole(roles: string | string[], organizationId?: string): boolean;
     setOrg(idOrSlug: string): void;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/web/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/web/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,EAAE;QACZ,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,wEAAwE;IACxE,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,iBAAiB,GAAG,SAAS,CAAA;IAClC,WAAW,EAAE,aAAa,EAAE,CAAA;IAC5B,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACtE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/web/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,EAAE;QACZ,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,wEAAwE;IACxE,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,iBAAiB,GAAG,SAAS,CAAA;IAClC,WAAW,EAAE,aAAa,EAAE,CAAA;IAC5B,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/tenancy",
-  "version": "8.0.0-canary.3565",
+  "version": "8.0.0-canary.3568",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -44,17 +44,17 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/api": "8.0.0-canary.3565",
-    "@cedarjs/context": "8.0.0-canary.3565",
-    "@cedarjs/graphql-server": "8.0.0-canary.3565"
+    "@cedarjs/api": "8.0.0-canary.3568",
+    "@cedarjs/context": "8.0.0-canary.3568",
+    "@cedarjs/graphql-server": "8.0.0-canary.3568"
   },
   "devDependencies": {
     "@apollo/client": "4.3.5",
     "@arethetypeswrong/cli": "0.18.5",
-    "@cedarjs/auth": "8.0.0-canary.3565",
-    "@cedarjs/framework-tools": "8.0.0-canary.3565",
-    "@cedarjs/router": "8.0.0-canary.3565",
-    "@cedarjs/web": "8.0.0-canary.3565",
+    "@cedarjs/auth": "8.0.0-canary.3568",
+    "@cedarjs/framework-tools": "8.0.0-canary.3568",
+    "@cedarjs/router": "8.0.0-canary.3568",
+    "@cedarjs/web": "8.0.0-canary.3568",
     "@prisma/adapter-better-sqlite3": "7.10.1",
     "@prisma/client": "7.10.1",
     "@testing-library/dom": "10.4.2",
@@ -80,9 +80,9 @@
   },
   "peerDependencies": {
     "@apollo/client": "4.3.5",
-    "@cedarjs/auth": "8.0.0-canary.3565",
-    "@cedarjs/router": "8.0.0-canary.3565",
-    "@cedarjs/web": "8.0.0-canary.3565",
+    "@cedarjs/auth": "8.0.0-canary.3568",
+    "@cedarjs/router": "8.0.0-canary.3568",
+    "@cedarjs/web": "8.0.0-canary.3568",
     "@prisma/client": "7.10.1",
     "react": "19.3.1"
   },

package/dist/auth.d.ts

@@ -1,65 +0,0 @@
-type Roles = string | readonly string[];
-/**
- * Whether the current request holds one of `roles` in an organization.
- *
- * With `organizationId`, this checks `context.currentUser.memberships` for a
- * membership in that specific organization — useful for checking access to
- * an organization other than the one in scope. Without it, this checks the
- * role on `context.currentOrg`, the organization already resolved for this
- * request.
- *
- * Returns `false` when there's no authenticated user, no matching
- * organization, or no matching membership. An empty `roles` array returns
- * `true` as long as a matching membership exists.
- */
-export declare function hasOrgRole(roles: Roles, organizationId?: string): boolean;
-export interface TenancyAuth {
-    /**
-     * Whether the signed-in user holds one of `roles` in `currentUser.roles`,
-     * in any organization or none. What the single-tenant `hasRole()` checked;
-     * `hasOrgRole()` checks the role in an organization.
-     */
-    hasUserRole(roles: Roles): boolean;
-    /**
-     * Guards a service or directive on the current organization: signed in,
-     * a member of the current organization and, when `roles` are given, with
-     * one of them there. With no `roles`, any member gets in, as any
-     * signed-in user gets past the single-tenant `requireAuth()`: use `roles`
-     * or `requirePermission()` for anything narrower.
-     *
-     * Throws `AuthenticationError` when no one is signed in, and
-     * `ForbiddenError` otherwise.
-     */
-    requireOrgAuth(options?: {
-        roles?: Roles;
-    }): void;
-    /**
-     * Guards a service or directive on the signed-in user alone, in any
-     * organization or none: their account, their memberships, accepting an
-     * invitation. When `roles` are given, the user needs one of them in
-     * `currentUser.roles`.
-     *
-     * Throws `AuthenticationError` when no one is signed in, and
-     * `ForbiddenError` otherwise.
-     */
-    requireUserAuth(options?: {
-        roles?: Roles;
-    }): void;
-    /** The standalone `hasOrgRole`: with no roles, any membership */
-    hasOrgRole(roles?: Roles, organizationId?: string): boolean;
-}
-/**
- * The auth checks for an app with tenancy, which `api/src/lib/auth.ts`
- * exports in place of its single-tenant `hasRole` and `requireAuth`:
- *
- * ```ts
- * export const { hasUserRole, hasOrgRole, requireUserAuth, requireOrgAuth } =
- *   createTenancyAuth()
- * ```
- *
- * There's no `hasRole` or `requireAuth`: every check says whether it's
- * about the signed-in user alone or the current organization.
- */
-export declare function createTenancyAuth(): TenancyAuth;
-export {};
-//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAKA,KAAK,KAAK,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;AAwBvC;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CA4BzE;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAA;IAClC;;;;;;;;;OASG;IACH,cAAc,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,KAAK,CAAA;KAAE,GAAG,IAAI,CAAA;IACjD;;;;;;;;OAQG;IACH,eAAe,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,KAAK,CAAA;KAAE,GAAG,IAAI,CAAA;IAClD,iEAAiE;IACjE,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAC5D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,IAAI,WAAW,CA8C/C"}

package/dist/auth.js

@@ -1,72 +0,0 @@
-import { context } from "@cedarjs/context";
-import { AuthenticationError, ForbiddenError } from "@cedarjs/graphql-server";
-import { getCurrentOrg, isUserWithMemberships } from "./context.js";
-const toList = (roles) => roles === void 0 ? [] : typeof roles === "string" ? [roles] : [...roles];
-function userRoles() {
-  const roles = context.currentUser?.roles;
-  if (typeof roles === "string") {
-    return [roles];
-  }
-  if (Array.isArray(roles)) {
-    return roles.filter((role) => typeof role === "string");
-  }
-  return [];
-}
-function hasOrgRole(roles, organizationId) {
-  const roleList = toList(roles);
-  if (organizationId) {
-    const currentUser = context.currentUser;
-    if (!isUserWithMemberships(currentUser)) {
-      return false;
-    }
-    const membership = currentUser.memberships.find(
-      (m) => m.organizationId === organizationId
-    );
-    if (!membership) {
-      return false;
-    }
-    return roleList.length === 0 || roleList.includes(membership.role);
-  }
-  const currentOrg = getCurrentOrg();
-  if (!currentOrg) {
-    return false;
-  }
-  return roleList.length === 0 || roleList.includes(currentOrg.role);
-}
-function createTenancyAuth() {
-  return {
-    hasUserRole(roles) {
-      const roleList = toList(roles);
-      return !!context.currentUser && userRoles().some((role) => roleList.includes(role));
-    },
-    requireUserAuth({ roles } = {}) {
-      if (!context.currentUser) {
-        throw new AuthenticationError("You don't have permission to do that.");
-      }
-      if (roles && !userRoles().some((role) => toList(roles).includes(role))) {
-        throw new ForbiddenError("You don't have access to do that.");
-      }
-    },
-    requireOrgAuth({ roles } = {}) {
-      if (!context.currentUser) {
-        throw new AuthenticationError("You don't have permission to do that.");
-      }
-      const currentOrg = getCurrentOrg();
-      if (!currentOrg) {
-        throw new ForbiddenError(
-          "You must be a member of an organization to do that."
-        );
-      }
-      if (roles && !toList(roles).includes(currentOrg.role)) {
-        throw new ForbiddenError("You don't have access to do that.");
-      }
-    },
-    hasOrgRole(roles = [], organizationId) {
-      return hasOrgRole(roles, organizationId);
-    }
-  };
-}
-export {
-  createTenancyAuth,
-  hasOrgRole
-};

package/dist/web/hasOrgRole.d.ts

@@ -1,12 +0,0 @@
-import type { OrgMembership } from './types.js';
-/**
- * Pure role check over a memberships snapshot, with no dependency on auth or
- * context. `useCurrentOrg().hasOrgRole` and the app's own code (checking a
- * membership other than the current organization's) both build on this.
- *
- * Returns `false` when there is no membership in `organizationId`. An empty
- * `roles` list returns `true` when a membership exists, matching
- * `@cedarjs/tenancy`'s server-side `hasOrgRole`.
- */
-export declare function hasOrgRole(memberships: readonly OrgMembership[] | undefined, roles: string | string[], organizationId: string): boolean;
-//# sourceMappingURL=hasOrgRole.d.ts.map

package/dist/web/hasOrgRole.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hasOrgRole.d.ts","sourceRoot":"","sources":["../../src/web/hasOrgRole.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,WAAW,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,EACjD,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,cAAc,EAAE,MAAM,GACrB,OAAO,CAgBT"}

package/dist/web/hasOrgRole.js

@@ -1,16 +0,0 @@
-function hasOrgRole(memberships, roles, organizationId) {
-  const membership = memberships?.find(
-    (candidate) => candidate.organizationId === organizationId
-  );
-  if (!membership) {
-    return false;
-  }
-  const roleList = Array.isArray(roles) ? roles : [roles];
-  if (roleList.length === 0) {
-    return true;
-  }
-  return roleList.includes(membership.role);
-}
-export {
-  hasOrgRole
-};