@classytic/arc 2.22.0 → 2.23.0

package/dist/scope-k15RXfcq.mjs

@@ -1,64 +0,0 @@
-import { n as normalizeRoles } from "./types-XTApa8b6.mjs";
-//#region src/scope/resolveOrgFromHeader.ts
-/**
-* Create a preHandler hook that resolves org scope from a header.
-* Must run AFTER authentication so `request.user` is populated.
-* If the header is present and user is a member, sets `request.scope` to `member`.
-* If the header is absent, scope stays as-is (typically `authenticated`).
-*/
-function resolveOrgFromHeader(options) {
-	const { header = "x-organization-id", resolveMembership } = options;
-	return async (request, reply) => {
-		const orgId = request.headers[header];
-		if (!orgId) return;
-		const scope = request.scope;
-		if (!scope || scope.kind === "public") {
-			reply.code(401).send({
-				success: false,
-				error: "Unauthorized",
-				message: "Authentication required for organization access",
-				code: "ORG_AUTH_REQUIRED"
-			});
-			return;
-		}
-		if (scope.kind === "elevated") return;
-		const user = request.user;
-		if (!user) {
-			reply.code(401).send({
-				success: false,
-				error: "Unauthorized",
-				message: "Authentication required for organization access",
-				code: "ORG_AUTH_REQUIRED"
-			});
-			return;
-		}
-		const userId = String(user.id ?? user._id ?? "");
-		if (!userId) {
-			reply.code(401).send({
-				success: false,
-				error: "Unauthorized",
-				message: "User identity required for organization access"
-			});
-			return;
-		}
-		const membership = await resolveMembership(userId, orgId);
-		if (!membership) {
-			reply.code(403).send({
-				success: false,
-				error: "Forbidden",
-				message: "Not a member of this organization",
-				code: "ORG_ACCESS_DENIED"
-			});
-			return;
-		}
-		request.scope = {
-			kind: "member",
-			userId: userId || void 0,
-			userRoles: normalizeRoles(user.role),
-			organizationId: orgId,
-			orgRoles: membership.roles
-		};
-	};
-}
-//#endregion
-export { resolveOrgFromHeader as t };