@cedarjs/tenancy 8.0.0-canary.3569 → 8.0.0-canary.3571

package/README.md

@@ -85,14 +85,15 @@ organization: fields about an organization ask for a permission (below).
 ## Permissions
 
 Roles in an organization are named bundles of permissions, defined in one
-place. Fields, services and components check a permission in an
+place with `definePermissions` from
+`@cedarjs/permissions`. Fields, services and components check a permission in an
 organization, never the membership's role, so a role can do exactly what its
 list says. `hasRole` and `<PrivateSet roles>` check the user's own roles, in
 `currentUser.roles`.
 
 ```ts
 // packages/permissions/src/index.ts, shared by the api and web sides
-import { definePermissions } from '@cedarjs/tenancy/permissions'
+import { definePermissions } from '@cedarjs/permissions'
 
 const member = ['organization.read', 'projects.read'] as const
 
@@ -149,7 +150,7 @@ side. Pass the tenancy to the router and put organization routes in a
 immutable organization id so switching organizations never mixes caches, around
 the set's layouts and page. `useAuth().hasPermission()` checks what the user
 may do in the organization. To guard routes by a permission of the user's
-membership, give a `PrivateSet` `orgPermission` and `unauthorized`:
+membership, give a `PrivateSet` `permission` and `unauthorized`:
 
 <!-- prettier-ignore -->
 ```tsx
@@ -159,7 +160,7 @@ import { tenancy } from 'src/tenancy'
   <PrivateSet wrap={OrgLayout} unauthenticated="login">
     <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
   </PrivateSet>
-  <PrivateSet wrap={OrgLayout} unauthenticated="login" unauthorized="projects" orgPermission="members.manage">
+  <PrivateSet wrap={OrgLayout} unauthenticated="login" unauthorized="projects" permission="members.manage">
     <Route path="/org/{orgSlug}/members" page={MembersPage} name="members" />
   </PrivateSet>
 </Router>
@@ -175,9 +176,9 @@ export const tenancy = createTenancy({
 
 The router checks the permission in the organization that `tenancy.useOrg`
 returns. The default `useOrg` finds it by the route's `orgSlug` param, and a
-custom one can find it another way, such as from the host. A `PrivateSet` with `orgPermission` throws when
-the router has no `tenancy` or its `useOrg` finds no organization for the
-route; with the default lookup, that's a route without `{orgSlug}`. A route
+custom one can find it another way, such as from the host. A `PrivateSet` with
+`permission` throws when `useOrg` finds no organization for the route; with the
+default lookup, that's a route without `{orgSlug}`. A route
 with `{orgSlug}` outside a `PrivateSet` is a public page with no organization
 context. `useAuth().hasRole` and `<PrivateSet roles>` check
 `currentUser.roles`, the user's own roles, as in an app without tenancy;

package/dist/permissions.d.ts

@@ -1,6 +1,4 @@
-import type { PermissionDefinitions } from './definePermissions.js';
-export { definePermissions } from './definePermissions.js';
-export type { PermissionDefinitions, PermissionName, } from './definePermissions.js';
+import type { PermissionDefinitions } from '@cedarjs/permissions';
 /** What `permissionsOf` needs to know about a membership */
 export interface MembershipForPermissions {
     role: string;

package/dist/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAEnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,YAAY,EACV,qBAAqB,EACrB,cAAc,GACf,MAAM,wBAAwB,CAAA;AAE/B,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wEAAwE;AACxE,MAAM,MAAM,eAAe,CACzB,UAAU,EACV,UAAU,SAAS,MAAM,IACvB,UAAU,GAAG;IAAE,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,CAAA;AAE9C,MAAM,WAAW,WAAW,CAAC,UAAU,SAAS,MAAM;IACpD;;;;OAIG;IACH,aAAa,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAA;IAC9C;;;;OAIG;IACH,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAA;IAC/C;;;;;;;;OAQG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IACnC;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,wBAAwB,GAAG,UAAU,EAAE,CAAA;IACjE;;;;OAIG;IACH,eAAe,CAAC,IAAI,SAAS;QAAE,WAAW,EAAE,wBAAwB,EAAE,CAAA;KAAE,EACtE,IAAI,EAAE,IAAI,GACT,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG;QAC7B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAA;KACxE,CAAA;IACD,eAAe,CAAC,IAAI,SAAS;QAAE,WAAW,EAAE,wBAAwB,EAAE,CAAA;KAAE,EACtE,IAAI,EAAE,IAAI,GAAG,IAAI,GAEf,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG;QAC3B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAA;KACxE,CAAC,GACF,IAAI,CAAA;CACT;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,UAAU,SAAS,MAAM,EAC/D,WAAW,EAAE,qBAAqB,CAAC,UAAU,CAAC,GAC7C,WAAW,CAAC,UAAU,CAAC,CAqGzB"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAIjE,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wEAAwE;AACxE,MAAM,MAAM,eAAe,CACzB,UAAU,EACV,UAAU,SAAS,MAAM,IACvB,UAAU,GAAG;IAAE,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,CAAA;AAE9C,MAAM,WAAW,WAAW,CAAC,UAAU,SAAS,MAAM;IACpD;;;;OAIG;IACH,aAAa,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAA;IAC9C;;;;OAIG;IACH,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAA;IAC/C;;;;;;;;OAQG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IACnC;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,wBAAwB,GAAG,UAAU,EAAE,CAAA;IACjE;;;;OAIG;IACH,eAAe,CAAC,IAAI,SAAS;QAAE,WAAW,EAAE,wBAAwB,EAAE,CAAA;KAAE,EACtE,IAAI,EAAE,IAAI,GACT,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG;QAC7B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAA;KACxE,CAAA;IACD,eAAe,CAAC,IAAI,SAAS;QAAE,WAAW,EAAE,wBAAwB,EAAE,CAAA;KAAE,EACtE,IAAI,EAAE,IAAI,GAAG,IAAI,GAEf,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG;QAC3B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAA;KACxE,CAAC,GACF,IAAI,CAAA;CACT;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,UAAU,SAAS,MAAM,EAC/D,WAAW,EAAE,qBAAqB,CAAC,UAAU,CAAC,GAC7C,WAAW,CAAC,UAAU,CAAC,CAoFzB"}

package/dist/permissions.js

@@ -1,18 +1,15 @@
 import { context } from "@cedarjs/context";
 import { AuthenticationError, ForbiddenError } from "@cedarjs/graphql-server";
+import {
+  assertPermission,
+  assertPermissionDefinitions,
+  coversRole,
+  permissionsOf as rolePermissions
+} from "@cedarjs/permissions";
 import { getCurrentOrg, isUserWithMemberships } from "./context.js";
-import { assertPermissionDefinitions } from "./definePermissions.js";
-import { definePermissions } from "./definePermissions.js";
 function createPermissions(definitions) {
   assertPermissionDefinitions(definitions);
-  const assertDefined = (permission) => {
-    if (!definitions.permissions.includes(permission)) {
-      throw new Error(
-        `Unknown permission "${permission}". Add it to \`permissions\` in your permission definitions before using it.`
-      );
-    }
-  };
-  const permissionsOf = (membership) => Object.hasOwn(definitions.roles, membership.role) ? [...definitions.roles[membership.role]] : [];
+  const permissionsOf = (membership) => rolePermissions(definitions, membership.role);
   const currentMembership = () => {
     const currentOrg = getCurrentOrg();
     if (!currentOrg) {
@@ -23,7 +20,7 @@ function createPermissions(definitions) {
     return { ...membership, role: currentOrg.role };
   };
   const hasPermission = (permission) => {
-    assertDefined(permission);
+    assertPermission(definitions, permission);
     if (!context.currentUser) {
       return false;
     }
@@ -48,16 +45,10 @@ function createPermissions(definitions) {
     withPermissions,
     canGrantRole(role) {
       const membership = context.currentUser ? currentMembership() : void 0;
-      if (!membership || !Object.hasOwn(definitions.roles, role)) {
-        return false;
-      }
-      const held = permissionsOf(membership);
-      return definitions.roles[role].every(
-        (permission) => held.includes(permission)
-      );
+      return !!membership && coversRole(definitions, permissionsOf(membership), role);
     },
     requirePermission(permission) {
-      assertDefined(permission);
+      assertPermission(definitions, permission);
       if (!context.currentUser) {
         throw new AuthenticationError("You don't have permission to do that.");
       }
@@ -73,6 +64,5 @@ function createPermissions(definitions) {
   };
 }
 export {
-  createPermissions,
-  definePermissions
+  createPermissions
 };

package/dist/web/createTenancy.d.ts

@@ -36,7 +36,7 @@ export interface CreateTenancyOptions {
  * Makes the `tenancy` to pass to the `Router`. The router then renders the
  * organization's provider itself, around the layouts and page of every
  * `PrivateSet` whose route is in an organization (by default, one with
- * `{orgSlug}` in its path), and checks `orgPermission` on those sets.
+ * `{orgSlug}` in its path), and checks `permission` on those sets in it.
  *
  * Call it once, at the top level of a module, like `web/src/tenancy.tsx`:
  * a new tenancy on each render would remount the provider.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/tenancy",
-  "version": "8.0.0-canary.3569",
+  "version": "8.0.0-canary.3571",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -15,12 +15,6 @@
         "default": "./dist/index.js"
       }
     },
-    "./permissions": {
-      "default": {
-        "types": "./dist/definePermissions.d.ts",
-        "default": "./dist/definePermissions.js"
-      }
-    },
     "./web": {
       "default": {
         "types": "./dist/web/index.d.ts",
@@ -44,17 +38,18 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/api": "8.0.0-canary.3569",
-    "@cedarjs/context": "8.0.0-canary.3569",
-    "@cedarjs/graphql-server": "8.0.0-canary.3569"
+    "@cedarjs/api": "8.0.0-canary.3571",
+    "@cedarjs/context": "8.0.0-canary.3571",
+    "@cedarjs/graphql-server": "8.0.0-canary.3571",
+    "@cedarjs/permissions": "8.0.0-canary.3571"
   },
   "devDependencies": {
     "@apollo/client": "4.3.5",
     "@arethetypeswrong/cli": "0.18.5",
-    "@cedarjs/auth": "8.0.0-canary.3569",
-    "@cedarjs/framework-tools": "8.0.0-canary.3569",
-    "@cedarjs/router": "8.0.0-canary.3569",
-    "@cedarjs/web": "8.0.0-canary.3569",
+    "@cedarjs/auth": "8.0.0-canary.3571",
+    "@cedarjs/framework-tools": "8.0.0-canary.3571",
+    "@cedarjs/router": "8.0.0-canary.3571",
+    "@cedarjs/web": "8.0.0-canary.3571",
     "@prisma/adapter-better-sqlite3": "7.10.1",
     "@prisma/client": "7.10.1",
     "@testing-library/dom": "10.4.2",
@@ -80,9 +75,9 @@
   },
   "peerDependencies": {
     "@apollo/client": "4.3.5",
-    "@cedarjs/auth": "8.0.0-canary.3569",
-    "@cedarjs/router": "8.0.0-canary.3569",
-    "@cedarjs/web": "8.0.0-canary.3569",
+    "@cedarjs/auth": "8.0.0-canary.3571",
+    "@cedarjs/router": "8.0.0-canary.3571",
+    "@cedarjs/web": "8.0.0-canary.3571",
     "@prisma/client": "7.10.1",
     "react": "19.3.1"
   },

package/dist/definePermissions.d.ts

@@ -1,48 +0,0 @@
-/**
- * Every permission an app checks, and what the built-in roles may do.
- *
- * Plain data with no api code in it, so both sides can import it: the api to
- * check permissions (`createPermissions`), and the web for the names.
- */
-export interface PermissionDefinitions<Name extends string = string> {
-    /**
-     * Every permission the app checks, by name. Fields, services and the web
-     * ask for these names, so they're defined in code. A name is a stable id,
-     * so it can also key what an app shows for it, such as translations.
-     */
-    permissions: readonly Name[];
-    /**
-     * What each built-in role may do in an organization. A role that isn't
-     * listed has no permissions.
-     */
-    roles: Readonly<Record<string, readonly Name[]>>;
-}
-/** The permission names in `definitions` */
-export type PermissionName<Definitions> = Definitions extends PermissionDefinitions<infer Name> ? Name : never;
-/**
- * Throws when a role lists a permission that `permissions` doesn't define. The types catch this in TypeScript; this is for
- * JavaScript, and for definitions built at runtime.
- */
-export declare function assertPermissionDefinitions(definitions: PermissionDefinitions): void;
-/**
- * Defines an app's permissions, and what each built-in role may do.
- * Permission names are typed from `permissions`, so a role listing a name
- * that isn't defined is a type error.
- *
- * ```ts
- * export const permissions = definePermissions({
- *   permissions: ['projects.read', 'members.manage'],
- *   roles: {
- *     owner: ['projects.read', 'members.manage'],
- *     member: ['projects.read'],
- *   },
- * })
- * ```
- *
- * Pass the result to `createPermissions` on the api.
- */
-export declare function definePermissions<const Name extends string>(definitions: {
-    permissions: readonly Name[];
-    roles: Readonly<Record<string, readonly NoInfer<Name>[]>>;
-}): PermissionDefinitions<Name>;
-//# sourceMappingURL=definePermissions.d.ts.map

package/dist/definePermissions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"definePermissions.d.ts","sourceRoot":"","sources":["../src/definePermissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IACjE;;;;OAIG;IACH,WAAW,EAAE,SAAS,IAAI,EAAE,CAAA;IAC5B;;;OAGG;IACH,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAA;CACjD;AAED,4CAA4C;AAC5C,MAAM,MAAM,cAAc,CAAC,WAAW,IACpC,WAAW,SAAS,qBAAqB,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,CAAA;AAEtE;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,qBAAqB,QAanC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAAE,WAAW,EAAE;IACxE,WAAW,EAAE,SAAS,IAAI,EAAE,CAAA;IAC5B,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;CAC1D,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAI9B"}

package/dist/definePermissions.js

@@ -1,20 +0,0 @@
-function assertPermissionDefinitions(definitions) {
-  const defined = new Set(definitions.permissions);
-  for (const [role, names] of Object.entries(definitions.roles)) {
-    for (const name of names) {
-      if (!defined.has(name)) {
-        throw new Error(
-          `Unknown permission "${name}" in role "${role}". Add it to \`permissions\` in your permission definitions first.`
-        );
-      }
-    }
-  }
-}
-function definePermissions(definitions) {
-  assertPermissionDefinitions(definitions);
-  return definitions;
-}
-export {
-  assertPermissionDefinitions,
-  definePermissions
-};