@happyvertical/smrt-template-sveltekit 0.38.26 → 0.39.0

package/template/src/lib/server/tenancy.ts

@@ -1,267 +1,114 @@
 /**
- * Tenant resolution for SvelteKit requests.
+ * Tenant selection for SvelteKit requests.
  *
- * This file is intentionally pluggable — consumers can swap the strategy
- * function without forking. The shipped default is subdomain-based:
+ * Selection and authorization are deliberately separate:
  *
- *   acme.demo.local       → tenantId='acme'
- *   www.demo.local        → tenantId=null
- *   demo.local            → tenantId=null
- *   localhost / 127.0.0.1 → tenantId=null
+ * - this module maps a trusted URL shape (the leading subdomain) to an active
+ *   tenant record;
+ * - `createSessionHandler({ enterTenantContext: true })` authorizes the signed-
+ *   in user's active membership and establishes the request tenant context.
  *
- * The resolver's signature is intentionally minimal — it accepts a
- * SvelteKit-like `RequestEvent` (typed structurally so this module has zero
- * `@sveltejs/kit` runtime dependency) and returns a synchronous result.
- *
- * @example Swap to path-prefix resolution
- * ```ts
- * // src/lib/server/tenancy.ts (your project)
- * import { createTenantResolver, pathPrefixStrategy } from './tenancy';
- *
- * export const resolveTenant = createTenantResolver(pathPrefixStrategy);
- * ```
- *
- * @example Swap to header-based resolution
- * ```ts
- * import { createTenantResolver, headerStrategy } from './tenancy';
- *
- * export const resolveTenant = createTenantResolver(
- *   headerStrategy({ headerName: 'x-tenant-id' }),
- * );
- * ```
- *
- * @example Compose your own
- * ```ts
- * import { createTenantResolver, subdomainStrategy } from './tenancy';
- *
- * export const resolveTenant = createTenantResolver((event) => {
- *   // Try subdomain first, then fall back to a header
- *   const fromSubdomain = subdomainStrategy(event);
- *   if (fromSubdomain.tenantId) return fromSubdomain;
- *   return { tenantId: event.request.headers.get('x-tenant-id') };
- * });
- * ```
+ * A selected tenant is useful for login and membership-gated switch flows, but
+ * it never becomes ambient query authority by itself. In particular, this
+ * resolver ignores client-provided tenant headers.
  */
 
-/**
- * Structural SvelteKit RequestEvent — only the bits we need for tenant
- * resolution. Keeping this minimal means the module has no @sveltejs/kit
- * runtime import, which keeps tests + non-SvelteKit consumers happy.
- */
+import {
+  TenantCollection,
+  TenantStatus,
+} from '@happyvertical/smrt-users';
+
+import { getSmrtConfig } from './smrt.js';
+
 export interface TenantResolverEvent {
   url: URL;
   request: { headers: Headers };
-  params?: Record<string, string | undefined>;
 }
 
-/**
- * Resolution result. `null` means "no tenant for this request".
- */
-export interface TenantResolution {
+export interface TenantSelection {
+  /** Database UUID for an active tenant, or null when none resolves. */
   tenantId: string | null;
+  /** URL-derived slug. Informational until membership authorizes a switch. */
+  tenantSlug: string | null;
 }
 
-/**
- * A resolver strategy is just a function from event → resolution. Sync or
- * async — the dispatcher awaits the return value.
- */
-export type TenantResolverStrategy = (
-  event: TenantResolverEvent,
-) => TenantResolution | Promise<TenantResolution>;
-
-/**
- * Hostnames that should never produce a tenant id, regardless of how many
- * dots they contain. Treats `localhost`, `127.0.0.1`, and `::1` as
- * tenant-less so local dev "just works" until you set up a wildcard DNS
- * entry like `*.demo.local → 127.0.0.1`.
- */
 const ROOT_LIKE_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+const RESERVED_SUBDOMAINS = new Set(['www', 'api', 'app', 'admin']);
 
 /**
- * Subdomain labels that are *never* tenant slugs even if they appear in the
- * leading position. Consumers can pass their own list to
- * {@link subdomainStrategyWith} if they need to extend this.
- */
-const DEFAULT_RESERVED_SUBDOMAINS = new Set(['www', 'api', 'app']);
-
-/**
- * Strategy: extract the tenant id from the leading subdomain.
+ * Pure URL parser used by the default resolver.
  *
- * Behavior:
- *   - `acme.demo.local`            → `{ tenantId: 'acme' }`
- *   - `acme.beta.demo.local`       → `{ tenantId: 'acme' }`  (only leading label)
- *   - `www.demo.local`             → `{ tenantId: null }`    (reserved)
- *   - `demo.local`                 → `{ tenantId: null }`    (no leading subdomain)
- *   - `localhost`                  → `{ tenantId: null }`
- *   - `127.0.0.1` or any IPv4/IPv6 → `{ tenantId: null }`
+ * Set `TENANT_BASE_DOMAIN` in production so multi-label public suffixes are
+ * never guessed. Without it, the fallback is intended only for local domains
+ * such as `acme.demo.local`.
  */
-export const subdomainStrategy: TenantResolverStrategy = (event) => {
-  return subdomainStrategyWith()(event);
-};
-
-/**
- * Customizable subdomain strategy. Use this if you need to extend the
- * reserved-subdomain list (e.g. to also reject `admin.demo.local`) or
- * to deploy on a multi-label public suffix like `example.co.uk` where
- * a naive label count would treat the apex itself as a tenant.
- *
- * The supplied `reservedSubdomains` are **merged with** the built-in
- * defaults (`www`, `api`, `app`) — `www`, `api`, and `app` always stay
- * reserved regardless of what you pass. Pass `[]` or omit the option
- * if you only need the defaults; the merge is additive-only. Replacing
- * the default list outright is not currently supported via this
- * strategy — fork the function or wire your own `TenantResolverStrategy`
- * if you need that.
- *
- * `baseDomain` (strongly recommended for production) anchors the apex.
- * When set, the strategy strips the matching suffix and treats whatever
- * leading labels remain as the tenant. `example.co.uk` with
- * `baseDomain: 'example.co.uk'` → no tenant; `acme.example.co.uk` →
- * `'acme'`. Without `baseDomain` the strategy falls back to a label-
- * count heuristic that works for `.com`/`.net`/`.dev`-style single-
- * label TLDs but mis-identifies multi-label public suffixes (`.co.uk`,
- * `.com.au`, `.gov.uk`, …) as tenant subdomains.
- */
-export function subdomainStrategyWith(opts?: {
-  reservedSubdomains?: Iterable<string>;
-  /**
-   * Apex domain to anchor tenant detection against. Highly recommended
-   * for production deployments on multi-label public suffixes
-   * (`example.co.uk`, `example.com.au`, …). When set, a request for
-   * exactly that host returns `{ tenantId: null }`, and a request for
-   * `<tenant>.<baseDomain>` returns `{ tenantId: '<tenant>' }`. Subdomain
-   * resolution stops being label-count-dependent.
-   */
-  baseDomain?: string;
-}): TenantResolverStrategy {
-  const reserved = new Set<string>(DEFAULT_RESERVED_SUBDOMAINS);
-  if (opts?.reservedSubdomains) {
-    for (const s of opts.reservedSubdomains) {
-      reserved.add(s.toLowerCase());
-    }
+export function selectTenantSlug(
+  url: URL,
+  baseDomain = process.env.TENANT_BASE_DOMAIN,
+): string | null {
+  const hostname = url.hostname.toLowerCase();
+  if (
+    ROOT_LIKE_HOSTS.has(hostname) ||
+    /^\d{1,3}(\.\d{1,3}){3}$/.test(hostname)
+  ) {
+    return null;
   }
-  const baseDomain = opts?.baseDomain?.toLowerCase().replace(/^\.+|\.+$/g, '');
-
-  return (event) => {
-    const hostname = event.url.hostname.toLowerCase();
-
-    if (ROOT_LIKE_HOSTS.has(hostname)) {
-      return { tenantId: null };
-    }
 
-    // Reject bare IPv4 (e.g. `192.168.1.10`) — never a tenant subdomain.
-    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(hostname)) {
-      return { tenantId: null };
-    }
-
-    // Preferred path: caller supplied a baseDomain. Strip it and read
-    // whatever's left as the tenant. This works correctly for both
-    // simple TLDs (`example.com`) and multi-label public suffixes
-    // (`example.co.uk`).
-    if (baseDomain) {
-      if (hostname === baseDomain) {
-        return { tenantId: null };
-      }
-      const suffix = `.${baseDomain}`;
-      if (hostname.endsWith(suffix)) {
-        const leading = hostname.slice(0, -suffix.length);
-        // Take only the first label of whatever's left so
-        // `acme.beta.example.co.uk` still resolves to `acme`.
-        const candidate = leading.split('.')[0];
-        if (!candidate || reserved.has(candidate)) {
-          return { tenantId: null };
-        }
-        return { tenantId: candidate };
-      }
-      // Host doesn't match the configured apex — out of scope for this
-      // strategy, treat as tenant-less rather than guess.
-      return { tenantId: null };
-    }
-
-    // Fallback path: no baseDomain configured. Use a label-count
-    // heuristic that works for single-label TLDs. **This is incorrect
-    // for multi-label public suffixes** (`example.co.uk` has three
-    // labels and would be misread as `example` being a tenant on the
-    // `co.uk` root). Pass `baseDomain` to opt out of the heuristic on
-    // any production deployment that uses such a TLD.
+  const normalizedBase = baseDomain
+    ?.trim()
+    .toLowerCase()
+    .replace(/^\.+|\.+$/g, '');
+
+  let candidate: string | undefined;
+  if (normalizedBase) {
+    if (hostname === normalizedBase) return null;
+    const suffix = `.${normalizedBase}`;
+    if (!hostname.endsWith(suffix)) return null;
+    candidate = hostname.slice(0, -suffix.length).split('.')[0];
+  } else {
     const labels = hostname.split('.');
+    if (labels.length < 3) return null;
+    candidate = labels[0];
+  }
 
-    // Need at least 3 labels for a tenant subdomain: <tenant>.<root>.<tld>.
-    // `demo.local` (2 labels) has no subdomain.
-    if (labels.length < 3) {
-      return { tenantId: null };
-    }
-
-    const candidate = labels[0];
-    if (!candidate || reserved.has(candidate)) {
-      return { tenantId: null };
-    }
-
-    return { tenantId: candidate };
-  };
+  return candidate && !RESERVED_SUBDOMAINS.has(candidate) ? candidate : null;
 }
 
-/**
- * Strategy: extract the tenant id from a path prefix like `/t/<slug>/...`.
- * The prefix is configurable; default is `/t/`.
- *
- * @example
- * ```ts
- * // matches  /t/acme/dashboard  → tenantId='acme'
- * createTenantResolver(pathPrefixStrategy());
- *
- * // matches  /tenant/acme/...   → tenantId='acme'
- * createTenantResolver(pathPrefixStrategy({ prefix: '/tenant/' }));
- * ```
- */
-export function pathPrefixStrategy(opts?: {
-  prefix?: string;
-}): TenantResolverStrategy {
-  const prefix = opts?.prefix ?? '/t/';
-  return (event) => {
-    const path = event.url.pathname;
-    if (!path.startsWith(prefix)) {
-      return { tenantId: null };
-    }
-    const rest = path.slice(prefix.length);
-    const slug = rest.split('/')[0];
-    return { tenantId: slug && slug.length > 0 ? slug : null };
-  };
+function isMissingTenantTable(error: unknown): boolean {
+  if (!(error instanceof Error)) return false;
+  const code = (error as Error & { code?: string }).code;
+  return (
+    code === '42P01' ||
+    error.message.includes('relation "tenants" does not exist') ||
+    error.message.includes('no such table: tenants')
+  );
 }
 
-/**
- * Strategy: read the tenant id from a request header.
- *
- * @example
- * ```ts
- * createTenantResolver(headerStrategy({ headerName: 'x-tenant-id' }));
- * ```
- */
-export function headerStrategy(opts?: {
-  headerName?: string;
-}): TenantResolverStrategy {
-  const headerName = opts?.headerName ?? 'x-tenant-id';
-  return (event) => {
-    const value = event.request.headers.get(headerName);
-    return { tenantId: value && value.length > 0 ? value : null };
-  };
+async function findActiveTenantId(slug: string): Promise<string | null> {
+  try {
+    const tenants = await TenantCollection.create(getSmrtConfig('Tenant'));
+    const tenant = await tenants.findBySlug(slug);
+    return tenant?.status === TenantStatus.ACTIVE ? (tenant.id ?? null) : null;
+  } catch (error) {
+    // A fresh project can render before its first `pnpm db:migrate`.
+    if (isMissingTenantTable(error)) return null;
+    throw error;
+  }
 }
 
 /**
- * Wrap any strategy into a resolver. This is a thin factory — its purpose
- * is to give consumers a single, stable entry point (`resolveTenant`) they
- * can swap by changing only the argument.
+ * Default selection extension point. Replace this function when your tenant
+ * key comes from a path, signed cookie, or trusted gateway assertion. Preserve
+ * the rule that selection alone does not establish authorization context.
  */
-export function createTenantResolver(
-  strategy: TenantResolverStrategy,
-): (event: TenantResolverEvent) => Promise<TenantResolution> {
-  return async (event) => {
-    return await strategy(event);
+export async function resolveTenant(
+  event: TenantResolverEvent,
+): Promise<TenantSelection> {
+  const tenantSlug = selectTenantSlug(event.url);
+  if (!tenantSlug) return { tenantId: null, tenantSlug: null };
+
+  return {
+    tenantId: await findActiveTenantId(tenantSlug),
+    tenantSlug,
   };
 }
-
-/**
- * Default resolver used by `hooks.server.ts`. Swap the argument to
- * `createTenantResolver()` (or replace this export) to change strategies.
- */
-export const resolveTenant = createTenantResolver(subdomainStrategy);

package/template/src/routes/+layout.server.ts

@@ -1,69 +1,15 @@
-/**
- * Root layout server load — builds the AdminShell tenant navigation.
- *
- * The WASD AdminShell (`src/routes/+layout.svelte`) is the default chrome for
- * this app. Its left "tenant" rail is driven by a nav tree derived from the
- * SMRT manifest, and that tree is built HERE — server-side — rather than with a
- * client-side fetch. This mirrors the home page's data pattern
- * (`+page.server.ts`): data is produced during SSR, serialized into the initial
- * HTML, and hydrated on the client with no duplicate request.
- *
- * `tenantNavFromManifest()` is a pure function (data in → data out). It reads
- * the same generated manifest the runtime uses (`.smrt/manifest.json`, written
- * by `smrtPlugin()` and already loaded by `src/lib/server/smrt.ts`), so the nav
- * stays in sync with your `@smrt()` classes automatically instead of being
- * hand-maintained.
- *
- * This load reads no URL/params and declares no `depends()`, so after its
- * initial SSR run SvelteKit does not re-run it on client navigations — only on
- * a full reload or `invalidateAll()`. The manifest-derived nav is therefore
- * effectively static for the session, which is fine (the manifest is fixed at
- * build time). It is independent of each page's own load, so the home page's
- * `depends('smrt:items')` / `invalidate('smrt:items')` refresh flow is
- * untouched by this file.
- */
-
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { loadManifestFromPathSync } from '@happyvertical/smrt-core/manifest';
-import {
-  type ShellNavItem,
-  type SmrtManifestLike,
-  tenantNavFromManifest,
-} from '@happyvertical/smrt-svelte/workspace';
 import type { LayoutServerLoad } from './$types';
 
-export const load: LayoutServerLoad = async () => {
-  // Same manifest file `src/lib/server/smrt.ts` seeds the registry from. Reading
-  // it here returns the parsed object we hand to the pure nav builder; if it is
-  // not generated yet (fresh checkout before the first `vite dev`/`vite build`)
-  // we fall back to an empty rail rather than failing the whole layout.
-  const manifestPath = join(process.cwd(), '.smrt', 'manifest.json');
-
-  let nav: ShellNavItem[] = [];
-  if (existsSync(manifestPath)) {
-    const manifest = loadManifestFromPathSync(manifestPath);
-    if (manifest) {
-      // `tenantNavFromManifest` reads a documented subset of the manifest
-      // (`SmrtManifestLike`). The core `SmartObjectManifest` carries richer
-      // field types (e.g. `ApiConfig` has no index signature), so narrow it to
-      // the structural shape the pure helper consumes.
-      //
-      // `basePath: ''` emits page-style hrefs (`/items`) for the developer to
-      // wire to their own list routes. `sectionHints` groups classes by
-      // package into readable section titles — extend it as you add packages.
-      // `NavSection[]` is structurally a superset of `ShellNavItem[]`, so it
-      // feeds straight into <TenantNav items={nav}>.
-      nav = tenantNavFromManifest(manifest as unknown as SmrtManifestLike, {
-        basePath: '',
-        sectionHints: {
-          '@happyvertical/smrt-content': 'Content',
-          '@happyvertical/smrt-users': 'Users',
-        },
-      });
-    }
-  }
-
-  return { nav };
+/**
+ * Keep session and tenant state server-owned. The selected tenant is displayed
+ * separately from the tenant authorized by the active session.
+ */
+export const load: LayoutServerLoad = async ({ locals }) => {
+  return {
+    session: {
+      authenticated: Boolean(locals.user),
+      activeTenantId: locals.tenantId,
+      selectedTenantSlug: locals.selectedTenantSlug,
+    },
+  };
 };

package/template/src/routes/+layout.svelte

@@ -1,110 +1,98 @@
 <script lang="ts">
   import { page } from '$app/state';
+  import { Provider } from '@happyvertical/smrt-svelte';
   import {
     AdminShell,
     AppScopePanel,
-    type ShellStatusChip,
-    SystemStatusChips,
+    type ShellNavItem,
     TenantNav,
   } from '@happyvertical/smrt-svelte/workspace';
   import { ThemeProvider } from '@happyvertical/smrt-ui/themes';
-  // Self-hosted @font-face rules for the SMRT type stack (Space Grotesk /
-  // Inter / JetBrains Mono woff2). `<ThemeProvider>` supplies every `--smrt-*`
-  // token variable at runtime, but not the font FILES — this import loads them
-  // so `--smrt-font-family` renders as the real stack instead of falling back
-  // to system-ui. Bundled with the app; no CDN request.
   import '@happyvertical/smrt-ui/themes/styles/fonts.css';
   import type { LayoutProps } from './$types';
 
-  // `data.nav` is built server-side in `+layout.server.ts` from the SMRT
-  // manifest and hydrated here — no client-side nav fetch. `children` is the
-  // active page, which renders inside AdminShell's `<main>` and keeps its own
-  // server load + `invalidate` flow (see `+page.server.ts`).
   let { data, children }: LayoutProps = $props();
 
-  // Both wrappers are SSR-safe. ThemeProvider emits its `--smrt-*` token
-  // variables as an inline style computed during render (no `window`), so the
-  // tokens are present in the server HTML with no unstyled flash; it only reads
-  // `matchMedia` after mount to resolve `colorScheme="system"`. AdminShell's
-  // public core likewise renders statically and only wires WASD hotkeys /
-  // localStorage persistence after mount. Nothing here reads `window` or
-  // `localStorage` at module or render time. `$app/state`'s `page` is populated
-  // on the server too, so `currentHref` is correct on first paint.
   const currentHref = $derived(page.url.pathname);
+  const activeTenantLabel = $derived(
+    data.session.activeTenantId ? 'Authorized session tenant' : 'No active tenant',
+  );
 
-  // Minimal, static system chips. Full live wiring (job counts, dispatch
-  // depth, connection state) is a documented next step: feed real values
-  // through `systemFeed` (`@happyvertical/smrt-svelte/workspace/live`) or
-  // `activityFeed` (`@happyvertical/smrt-svelte/web`)
-  // — see the migration guide and the playground `admin-shell-system-feed`
-  // demo. Keeping these static here avoids loading the client engine on every
-  // page of the scaffold.
-  const statusChips: ShellStatusChip[] = [
-    { id: 'env', label: 'Local', tone: 'info' },
-    { id: 'connection', label: 'Ready', tone: 'success' },
+  // Add application routes here. Generated REST routes live under /api and do
+  // not automatically imply a human-facing page.
+  const nav: ShellNavItem[] = [
+    {
+      href: '/',
+      label: 'Items',
+      description: 'The example s-m-r-t object',
+    },
+    {
+      href: '/settings',
+      label: 'Settings',
+      description: 'Workspace layout and shortcuts',
+    },
   ];
 </script>
 
-<!--
-  ThemeProvider is the standard SMRT theming wrapper (mirrors the reference app
-  `@happyvertical/smrt-content` → `src/routes/+layout.svelte`). It injects the
-  full `--smrt-*` token set the shell and pages consume, and `colorScheme="system"`
-  follows the OS light/dark preference at runtime; `persist` remembers a user's
-  explicit choice. Wrap it OUTERMOST so AdminShell and every page render themed.
--->
-<ThemeProvider colorScheme="system" persist={true}>
-<AdminShell title="SMRT App" subtitle="SvelteKit" storageKey="smrt-app-shell">
-  {#snippet appPanel()}
-    <AppScopePanel
-      appName="SMRT App"
-      tenantName="Local development"
-      environment="local"
-      showSettings={false}
+<Provider>
+  <ThemeProvider preset="smrt" colorScheme="system" persist={true}>
+    <AdminShell
+      title="s-m-r-t app"
+      subtitle="SvelteKit"
+      storageKey="smrt-app-shell"
     >
-      {#snippet docs()}
-        <nav class="app-scope-links">
-          <a href="/settings">Shell settings</a>
-        </nav>
+      {#snippet appPanel()}
+        <AppScopePanel
+          appName="s-m-r-t app"
+          tenantName={activeTenantLabel}
+          environment="local"
+          showSettings={false}
+        >
+          {#snippet docs()}
+            {#if data.session.selectedTenantSlug}
+              <p class="tenant-selection">
+                Selected URL tenant: <strong>{data.session.selectedTenantSlug}</strong>
+              </p>
+            {/if}
+            <a href="/settings">Shell settings</a>
+          {/snippet}
+        </AppScopePanel>
       {/snippet}
-    </AppScopePanel>
-  {/snippet}
 
-  {#snippet tenantPanel()}
-    <TenantNav items={data.nav} {currentHref} />
-  {/snippet}
-
-  {#snippet systemBar()}
-    <div class="system-bar">
-      <SystemStatusChips chips={statusChips} />
-      <a class="system-bar__settings" href="/settings">Settings</a>
-    </div>
-  {/snippet}
+      {#snippet tenantPanel()}
+        <TenantNav items={nav} {currentHref} />
+      {/snippet}
 
-  {@render children()}
-</AdminShell>
-</ThemeProvider>
+      {@render children()}
+    </AdminShell>
+  </ThemeProvider>
+</Provider>
 
 <style>
+  :global(*),
+  :global(*::before),
+  :global(*::after) {
+    box-sizing: border-box;
+  }
+
+  :global(html),
   :global(body) {
+    min-height: 100%;
     margin: 0;
   }
 
-  .app-scope-links {
-    display: grid;
-    gap: var(--smrt-spacing-1);
+  :global(body) {
+    background: var(--smrt-color-background);
+    color: var(--smrt-color-on-background);
+    font-family: var(--smrt-typography-body-font-family, Inter, system-ui, sans-serif);
   }
 
-  .app-scope-links a,
-  .system-bar__settings {
-    color: var(--smrt-color-primary);
-    text-decoration: none;
+  .tenant-selection {
+    margin: 0 0 var(--smrt-spacing-2);
+    color: var(--smrt-color-on-surface-variant);
   }
 
-  .system-bar {
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
-    gap: var(--smrt-spacing-3);
-    inline-size: 100%;
+  a {
+    color: var(--smrt-color-primary);
   }
 </style>