@cedarjs/tenancy 8.0.0-canary.3567 → 8.0.0-canary.3569

package/README.md

@@ -73,33 +73,22 @@ import {
 - `getCurrentOrg()` / `requireCurrentOrg()` — read the organization set on the
   current request; the latter throws `TenantScopeError` when none is set.
 
-## Auth helpers
+## User checks
 
-```ts
-// api/src/lib/auth.ts, in place of the single-tenant hasRole/requireAuth
-import { createTenancyAuth } from '@cedarjs/tenancy'
-
-export const { hasUserRole, requireUserAuth } = createTenancyAuth()
-
-// In a service:
-requireUserAuth() // signed in, no organization needed
-
-// Anywhere:
-if (hasUserRole('superuser')) { ... } // currentUser.roles
-```
-
-`requireUserAuth` (and the `@requireUserAuth` directive `setup tenancy` adds)
-is for fields about the user rather than an organization: their account,
-their memberships, accepting an invitation. It needs a signed-in user, and
-checks `roles` against `currentUser.roles`. There's no `requireAuth` or
-`hasRole`, and no role check on the current organization: fields about an
-organization ask for a permission (below).
+`hasRole` and `requireAuth` in `api/src/lib/auth.ts`, and the `@requireAuth`
+directive, are for fields about the user rather than an organization: their
+account, their memberships, accepting an invitation. `requireAuth` needs a
+signed-in user, and both check `roles` against `currentUser.roles`: the user's own roles, in
+any organization or none. There's no role check on the current
+organization: fields about an organization ask for a permission (below).
 
 ## Permissions
 
-Roles are named bundles of permissions, defined in one place. Fields,
-services and components check permissions, never roles, so a role can do
-exactly what its list says.
+Roles in an organization are named bundles of permissions, defined in one
+place. Fields, services and components check a permission in an
+organization, never the membership's role, so a role can do exactly what its
+list says. `hasRole` and `<PrivateSet roles>` check the user's own roles, in
+`currentUser.roles`.
 
 ```ts
 // packages/permissions/src/index.ts, shared by the api and web sides
@@ -184,12 +173,13 @@ export const tenancy = createTenancy({
 })
 ```
 
-The router checks the permission in the organization of the route's
-`orgSlug` param. A `PrivateSet` with `orgPermission` throws when
+The router checks the permission in the organization that `tenancy.useOrg`
+returns. The default `useOrg` finds it by the route's `orgSlug` param, and a
+custom one can find it another way, such as from the host. A `PrivateSet` with `orgPermission` throws when
 the router has no `tenancy` or its `useOrg` finds no organization for the
 route; with the default lookup, that's a route without `{orgSlug}`. A route
 with `{orgSlug}` outside a `PrivateSet` is a public page with no organization
-context. `useAuth().hasUserRole` and `<PrivateSet userRoles>` check
-`currentUser.roles`; there's no `useAuth().hasRole` or `<PrivateSet roles>` in
-an app with tenancy. See the
+context. `useAuth().hasRole` and `<PrivateSet roles>` check
+`currentUser.roles`, the user's own roles, as in an app without tenancy;
+checks in an organization use a permission. See the
 how-to for the full setup `yarn cedar setup tenancy` generates.

package/dist/index.d.ts

@@ -1,6 +1,5 @@
 export * from './errors.js';
 export * from './context.js';
-export * from './auth.js';
 export * from './permissions.js';
 export { createTenancyExtension } from './prismaExtension.js';
 export type { ModelNamesFor, TenancyConfig, UnscopedClient, } from './prismaExtension.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,YAAY,EACV,aAAa,EACb,aAAa,EACb,cAAc,GACf,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,YAAY,EACV,aAAa,EACb,aAAa,EACb,cAAc,GACf,MAAM,sBAAsB,CAAA"}

package/dist/index.js

@@ -1,6 +1,5 @@
 export * from "./errors.js";
 export * from "./context.js";
-export * from "./auth.js";
 export * from "./permissions.js";
 import { createTenancyExtension } from "./prismaExtension.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/tenancy",
-  "version": "8.0.0-canary.3567",
+  "version": "8.0.0-canary.3569",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -44,17 +44,17 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/api": "8.0.0-canary.3567",
-    "@cedarjs/context": "8.0.0-canary.3567",
-    "@cedarjs/graphql-server": "8.0.0-canary.3567"
+    "@cedarjs/api": "8.0.0-canary.3569",
+    "@cedarjs/context": "8.0.0-canary.3569",
+    "@cedarjs/graphql-server": "8.0.0-canary.3569"
   },
   "devDependencies": {
     "@apollo/client": "4.3.5",
     "@arethetypeswrong/cli": "0.18.5",
-    "@cedarjs/auth": "8.0.0-canary.3567",
-    "@cedarjs/framework-tools": "8.0.0-canary.3567",
-    "@cedarjs/router": "8.0.0-canary.3567",
-    "@cedarjs/web": "8.0.0-canary.3567",
+    "@cedarjs/auth": "8.0.0-canary.3569",
+    "@cedarjs/framework-tools": "8.0.0-canary.3569",
+    "@cedarjs/router": "8.0.0-canary.3569",
+    "@cedarjs/web": "8.0.0-canary.3569",
     "@prisma/adapter-better-sqlite3": "7.10.1",
     "@prisma/client": "7.10.1",
     "@testing-library/dom": "10.4.2",
@@ -80,9 +80,9 @@
   },
   "peerDependencies": {
     "@apollo/client": "4.3.5",
-    "@cedarjs/auth": "8.0.0-canary.3567",
-    "@cedarjs/router": "8.0.0-canary.3567",
-    "@cedarjs/web": "8.0.0-canary.3567",
+    "@cedarjs/auth": "8.0.0-canary.3569",
+    "@cedarjs/router": "8.0.0-canary.3569",
+    "@cedarjs/web": "8.0.0-canary.3569",
     "@prisma/client": "7.10.1",
     "react": "19.3.1"
   },

package/dist/auth.d.ts

@@ -1,37 +0,0 @@
-type Roles = string | readonly string[];
-export interface TenancyAuth {
-    /**
-     * Whether the signed-in user holds one of `roles` in `currentUser.roles`,
-     * in any organization or none. What the single-tenant `hasRole()` checked.
-     */
-    hasUserRole(roles: Roles): boolean;
-    /**
-     * Guards a service or directive on the signed-in user alone, in any
-     * organization or none: their account, their memberships, accepting an
-     * invitation. When `roles` are given, the user needs one of them in
-     * `currentUser.roles`.
-     *
-     * Throws `AuthenticationError` when no one is signed in, and
-     * `ForbiddenError` otherwise.
-     */
-    requireUserAuth(options?: {
-        roles?: Roles;
-    }): void;
-}
-/**
- * The auth checks for an app with tenancy, which `api/src/lib/auth.ts`
- * exports in place of its single-tenant `hasRole` and `requireAuth`:
- *
- * ```ts
- * export const { hasUserRole, requireUserAuth } =
- *   createTenancyAuth()
- * ```
- *
- * There's no `hasRole` or `requireAuth`: every check says whether it's
- * about the signed-in user alone or the current organization. Checks on
- * the current organization are permissions (`createPermissions`), so a
- * role can do only what its entry in the permission definitions lists.
- */
-export declare function createTenancyAuth(): TenancyAuth;
-export {};
-//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAGA,KAAK,KAAK,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;AAwBvC,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAA;IAClC;;;;;;;;OAQG;IACH,eAAe,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,KAAK,CAAA;KAAE,GAAG,IAAI,CAAA;CACnD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,IAAI,WAAW,CAuB/C"}

package/dist/auth.js

@@ -1,32 +0,0 @@
-import { context } from "@cedarjs/context";
-import { AuthenticationError, ForbiddenError } from "@cedarjs/graphql-server";
-const toList = (roles) => typeof roles === "string" ? [roles] : [...roles];
-function userRoles() {
-  const roles = context.currentUser?.roles;
-  if (typeof roles === "string") {
-    return [roles];
-  }
-  if (Array.isArray(roles)) {
-    return roles.filter((role) => typeof role === "string");
-  }
-  return [];
-}
-function createTenancyAuth() {
-  return {
-    hasUserRole(roles) {
-      const roleList = toList(roles);
-      return !!context.currentUser && userRoles().some((role) => roleList.includes(role));
-    },
-    requireUserAuth({ roles } = {}) {
-      if (!context.currentUser) {
-        throw new AuthenticationError("You don't have permission to do that.");
-      }
-      if (roles && !userRoles().some((role) => toList(roles).includes(role))) {
-        throw new ForbiddenError("You don't have access to do that.");
-      }
-    }
-  };
-}
-export {
-  createTenancyAuth
-};