@hanzo/rooms 0.1.71 → 0.1.73

package/dist/lib/session.d.ts

@@ -123,11 +123,20 @@ export declare function own(sub: string | undefined): void;
  */
 export declare function follow(was: string | undefined, moved: () => void): () => void;
 /**
- * The organizations the token says this person belongs to, home first.
- * Empty for an account that has not made one: the SDK's own list falls back to
- * the `owner` claim, which is the application's org and nobody's to work in.
+ * The brands' directories (hanzoai/authz `IsDirectory`): the org a customer's
+ * account lives in, its home, and nobody's to work in. IAM lists the home first
+ * in the token's `orgs`; cloud opens a directory to no one.
+ */
+export declare const DIRECTORIES: readonly string[];
+/**
+ * The organizations this person works in, as the token names them: every org of
+ * its `orgs` but a directory, which is a home and nobody's tenant. Empty for an
+ * account that has not made one: the SDK's own list falls back to the `owner`
+ * claim, which is the application's org and nobody's to work in.
  */
 export declare function orgs(): string[];
+/** The org of the person's own row: the first entry of the token's `orgs`, a directory or not. */
+export declare function home(): string | null;
 /**
  * The reader's role in one organization as IAM signed it into the token's `orgs`
  * claim — owner, admin or member — or null where the token names no such org.
@@ -171,16 +180,11 @@ export declare const PICKED = "hanzo:org:picked";
  * app's account menu — is one the gate does not ask for again.
  */
 export declare function pick(o: string): void;
-/** The reserved org whose own people are the platform's operators. */
-export declare const ADMIN_ORG = "admin";
-/**
- * Whether the signed-in person is a SUPERADMIN, as IAM signs it: the org of the
- * person's own row — the first entry of the token's `orgs`, which IAM always puts
- * first (hanzoai/iam internal/store/membership.go `MemberOrgRefs`) — is the
- * reserved `admin` org. It is the equality IAM decides `assume` and the
- * organization list on (pkg/schema/user.go `SuperAdmin`) and cloud's `Super`.
- * Not the `owner` claim: a sign-in token carries the APPLICATION's org there. A
- * membership of `admin` is not it either, and neither is being an org's admin.
+/**
+ * Whether the signed-in person is a SUPERADMIN: @hanzo/iam's `superAdmin`, which is
+ * hanzoai/authz `Claims.Sudo` exactly — a person (never a program) whose own row's
+ * org, the first entry of the token's `orgs`, is the reserved `admin` org, compared
+ * verbatim. Not the `owner` claim, not a membership of `admin`, not an org's admin.
  * It decides only what is drawn: IAM refuses everyone else the list of every
  * organization and the step into one.
  */

package/dist/lib/session.js

@@ -14,6 +14,7 @@
  * who was signed in, which reads as a permissions problem rather than a typo.
  * Two derivations of one name never agree; this is the one derivation.
  */
+import { superAdmin as sudo } from '@hanzo/iam/browser';
 import { api } from './api.js';
 import { where } from '../where.js';
 /** The SDK's own keys, `hanzo_iam_`-prefixed. The far side of a boundary. */
@@ -305,12 +306,14 @@ function claims() {
     return claimsOf(bearer());
 }
 /**
- * The organizations the token says this person belongs to, home first.
- * Empty for an account that has not made one: the SDK's own list falls back to
- * the `owner` claim, which is the application's org and nobody's to work in.
+ * The brands' directories (hanzoai/authz `IsDirectory`): the org a customer's
+ * account lives in, its home, and nobody's to work in. IAM lists the home first
+ * in the token's `orgs`; cloud opens a directory to no one.
  */
-export function orgs() {
-    const set = claims()?.orgs;
+export const DIRECTORIES = ['hanzo-id', 'lux-id', 'zoo-id', 'pars-id'];
+/** Every org the token's `orgs` names, home first, each once. */
+function listed(token) {
+    const set = claimsOf(token)?.orgs;
     const out = [];
     for (const ref of Array.isArray(set) ? set : []) {
         const o = ref?.org;
@@ -319,6 +322,19 @@ export function orgs() {
     }
     return out;
 }
+/**
+ * The organizations this person works in, as the token names them: every org of
+ * its `orgs` but a directory, which is a home and nobody's tenant. Empty for an
+ * account that has not made one: the SDK's own list falls back to the `owner`
+ * claim, which is the application's org and nobody's to work in.
+ */
+export function orgs() {
+    return listed(bearer()).filter((o) => !DIRECTORIES.includes(o));
+}
+/** The org of the person's own row: the first entry of the token's `orgs`, a directory or not. */
+export function home() {
+    return listed(bearer())[0] ?? null;
+}
 /**
  * The reader's role in one organization as IAM signed it into the token's `orgs`
  * claim — owner, admin or member — or null where the token names no such org.
@@ -354,8 +370,8 @@ export function named() {
  */
 export function me() {
     const name = claims()?.name;
-    const home = orgs()[0];
-    return typeof name === 'string' && name && home ? `${home}/${name}` : null;
+    const at = home();
+    return typeof name === 'string' && name && at ? `${at}/${name}` : null;
 }
 /** The organization this browser works in: the SDK's selection, when it is one of the token's. */
 export function org() {
@@ -421,21 +437,16 @@ export function pick(o) {
     }
     window.dispatchEvent(new Event(ORG));
 }
-/** The reserved org whose own people are the platform's operators. */
-export const ADMIN_ORG = 'admin';
 /**
- * Whether the signed-in person is a SUPERADMIN, as IAM signs it: the org of the
- * person's own row — the first entry of the token's `orgs`, which IAM always puts
- * first (hanzoai/iam internal/store/membership.go `MemberOrgRefs`) — is the
- * reserved `admin` org. It is the equality IAM decides `assume` and the
- * organization list on (pkg/schema/user.go `SuperAdmin`) and cloud's `Super`.
- * Not the `owner` claim: a sign-in token carries the APPLICATION's org there. A
- * membership of `admin` is not it either, and neither is being an org's admin.
+ * Whether the signed-in person is a SUPERADMIN: @hanzo/iam's `superAdmin`, which is
+ * hanzoai/authz `Claims.Sudo` exactly — a person (never a program) whose own row's
+ * org, the first entry of the token's `orgs`, is the reserved `admin` org, compared
+ * verbatim. Not the `owner` claim, not a membership of `admin`, not an org's admin.
  * It decides only what is drawn: IAM refuses everyone else the list of every
  * organization and the step into one.
  */
 export function superAdmin() {
-    return orgs()[0] === ADMIN_ORG;
+    return sudo(claims());
 }
 /** The organization a SuperAdmin stepped into through IAM, from the token's `assumed` claim, or null. */
 export function assumed() {
@@ -471,15 +482,9 @@ export async function support(org) {
         throw new Error(body?.msg || `IAM answered ${res.status}.`);
     tokens().setItem(ACCESS, next);
     tokens().setItem(EXPIRES, String(exp * 1000));
-    pick(org ?? homeOf(next));
+    pick(org ?? listed(next).find((o) => !DIRECTORIES.includes(o)) ?? '');
     window.location.reload();
 }
-/** The org of the person's own row: the first entry of a token's `orgs`. */
-function homeOf(token) {
-    const set = claimsOf(token)?.orgs;
-    const first = Array.isArray(set) ? set[0]?.org : undefined;
-    return typeof first === 'string' ? first : '';
-}
 /**
  * Leave support mode when IAM cannot answer the step out: the stored token is
  * marked spent, so the SDK's refresh — which mints from the person's own grant

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/rooms",
-  "version": "0.1.71",
+  "version": "0.1.73",
   "description": "The workspace rooms — Home, Chat, Inbox, Contacts, Meet, Cal, Drive, Board, Work, Bots — and the frame that holds them, once, for every Hanzo surface.",
   "type": "module",
   "main": "./dist/index.js",
@@ -53,7 +53,7 @@
     "@hanzo/composer": ">=0.2.0",
     "@hanzo/event": ">=0.3.56",
     "@hanzo/gui": "^8.3.5",
-    "@hanzo/iam": ">=0.21.28",
+    "@hanzo/iam": ">=0.21.33",
     "@hanzo/logo": ">=1.0.26",
     "@hanzo/studio": ">=0.1.0",
     "@hanzo/ui": ">=8.27.67",
@@ -72,7 +72,7 @@
     "@hanzo/design": "0.5.34",
     "@hanzo/event": "0.3.56",
     "@hanzo/gui": "8.3.5",
-    "@hanzo/iam": "0.21.28",
+    "@hanzo/iam": "0.21.33",
     "@hanzo/logo": "1.0.26",
     "@hanzo/studio": "0.1.0",
     "@hanzo/ui": "8.27.67",