@getstrata/bootstrap 0.2.55 → 0.2.56

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @getstrata/bootstrap changelog
 
+## 0.2.56
+
+- Peer `@getstrata/core` `^0.5.69` for `MembershipLookup.updateMemberRole`.
+
 ## 0.2.55
 
 - HttpKernel and route builders read `isViewsEnabled` / `isSpaEnabled` from `@getstrata/core/runtime/frontendMode` instead of WorkHub `src/config/frontend`.

package/README.md

@@ -30,7 +30,7 @@ import { createHttpKernel, createAppContext, coreProviders } from "@getstrata/bo
 
 `createAppContext()` does not call `assertProductionSecrets`. WorkHub calls that from `App.serve()` / `queue:work`. Sibling HTMX apps can call it in production without WorkHub API tokens when feature flags are off — see [SIBLING-HTMX.md](../../docs/SIBLING-HTMX.md).
 
-Sibling HTMX apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. Use `signIn` / `signOut` (or the redirect helpers) instead of calling `CookieSessionStore` from controllers. Pass `mapUser` to map roles in the app. Pass `loadSessionUser` when the default `learn_subscriber` / `is_admin` SELECT does not match your schema.
+Sibling HTMX apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. Use `signIn` / `signOut` (or the redirect helpers) instead of calling `CookieSessionStore` from controllers. Pass `mapUser` to map roles in the app. Pass `loadSessionUser` when the default `learn_subscriber` / `is_admin` SELECT does not match your schema. WorkHub’s table is `sessions` (`0031_create_sessions`); its loader is `loadWorkhubSessionUser` (maps `users.role`, decrypts email). WorkHub web login itself stays on HMAC `SessionGuard`.
 
 `wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again.
 

package/dist/entries/createRoutes.js

@@ -743,7 +743,7 @@ function assertScimIfMatch(request, etagSource) {
 // ../../src/modules/scim/service.ts
 import { hashPassword as hashPassword3 } from "@getstrata/core/auth/password";
 import { resolveService } from "@getstrata/core/contracts/di";
-import { NotFoundError as NotFoundError4 } from "@getstrata/core/errors/http";
+import { NotFoundError as NotFoundError5 } from "@getstrata/core/errors/http";
 import { currentTenantId as currentTenantId4 } from "@getstrata/core/tenant/tenantContext";
 
 // ../../src/domain/scim.ts
@@ -755,6 +755,9 @@ var SCIM_SCHEMAS = {
   serviceProviderConfig: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"
 };
 
+// ../../src/modules/organization/memberRepository.ts
+import { NotFoundError } from "@getstrata/core/errors/http";
+
 // ../../src/config/database.ts
 function readInteger(name, fallback) {
   const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
@@ -912,6 +915,19 @@ class OrganizationMemberRepository {
     }
     return row;
   }
+  async updateMemberRole(organizationId, userId, role) {
+    const rows = await connection_default`
+      UPDATE organization_member
+      SET role = ${role}
+      WHERE organization_id = ${organizationId} AND user_id = ${userId}
+      RETURNING id, organization_id, user_id, role, created_at
+    `;
+    const row = rows[0];
+    if (!row) {
+      throw new NotFoundError(`Organization member ${userId} not found.`);
+    }
+    return row;
+  }
   async removeMember(organizationId, userId) {
     const rows = await connection_default`
       DELETE FROM organization_member
@@ -925,7 +941,7 @@ var memberRepository_default = OrganizationMemberRepository;
 
 // ../../src/modules/organization/repository.ts
 import { BaseRepository } from "@getstrata/core/database/baseRepository";
-import { NotFoundError } from "@getstrata/core/errors/http";
+import { NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
 import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
 
 // ../../src/modules/organization/table.ts
@@ -964,7 +980,7 @@ class OrganizationRepository extends BaseRepository {
   async findForTenantOrThrow(id, tenantId = currentTenantId()) {
     const organization = await this.findById(id);
     if (!organization || organization.tenant_id !== tenantId) {
-      throw new NotFoundError(`SCIM group ${id} not found.`);
+      throw new NotFoundError2(`SCIM group ${id} not found.`);
     }
     return organization;
   }
@@ -1054,7 +1070,7 @@ var notificationTable = defineTable3({
 });
 
 // ../../src/modules/user/notificationService.ts
-import { NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
+import { NotFoundError as NotFoundError3 } from "@getstrata/core/errors/http";
 
 // ../../src/modules/user/oauthIdentityRepository.ts
 import { BaseRepository as BaseRepository4 } from "@getstrata/core/database/baseRepository";
@@ -1112,7 +1128,7 @@ var userTable = defineTable5({
 
 // ../../src/modules/user/tokenService.ts
 import { hashApiToken as hashApiToken2 } from "@getstrata/core/auth/tokenHash";
-import { ForbiddenError, NotFoundError as NotFoundError3 } from "@getstrata/core/errors/http";
+import { ForbiddenError, NotFoundError as NotFoundError4 } from "@getstrata/core/errors/http";
 import { resolveDefaultTokenExpiryDays as resolveDefaultTokenExpiryDays2 } from "@getstrata/core/security/tokenExpiry";
 
 // ../../src/modules/user/provider.ts
@@ -1170,7 +1186,7 @@ class ScimService {
   async findUserRecord(id) {
     const user = await this.users.findById(id);
     if (!user || user.tenant_id !== currentTenantId4()) {
-      throw new NotFoundError4(`SCIM user ${id} not found.`);
+      throw new NotFoundError5(`SCIM user ${id} not found.`);
     }
     return user;
   }
@@ -1212,7 +1228,7 @@ class ScimService {
     const user = await this.findUserRecord(id);
     const deleted = await this.users.deleteById(id);
     if (!deleted) {
-      throw new NotFoundError4(`SCIM user ${id} not found.`);
+      throw new NotFoundError5(`SCIM user ${id} not found.`);
     }
     return { id: user.id, updated_at: user.updated_at };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.55",
+  "version": "0.2.56",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -180,7 +180,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^0.5.68",
+    "@getstrata/core": "^0.5.69",
     "typescript": "^5.9.0"
   }
 }