@headless-lms/adapter-auth 0.1.0 → 0.3.0

package/dist/access-grant.d.ts

@@ -0,0 +1,15 @@
+import { AccessScope } from "@headless-lms/core/organizations";
+import { AccessTokenAuthorization } from "better-auth/oauth2";
+import { AccessGrant } from "@headless-lms/core/types";
+//#region src/access-grant.d.ts
+declare function accessTokenAuthorization(header: string | string[] | undefined): AccessTokenAuthorization | null;
+declare function isCompactJws(token: string): boolean;
+declare function grantFromClaims(claims: Record<string, unknown>): AccessGrant | null;
+declare function needsOrgChoice(activeOrgId: string | null, memberOrgIds: () => Promise<readonly string[]>): Promise<boolean>;
+declare function consentOrgId(activeOrgId: string | null, memberOrgIds: () => Promise<readonly string[]>): Promise<string | null>;
+declare function orgIdFromMetadata(metadata: unknown): string | null;
+declare function scopesToPermissions(scopes: string[]): Record<string, string[]>;
+declare function permissionsToScopes(permissions: unknown): AccessScope[];
+//#endregion
+export { accessTokenAuthorization, consentOrgId, grantFromClaims, isCompactJws, needsOrgChoice, orgIdFromMetadata, permissionsToScopes, scopesToPermissions };
+//# sourceMappingURL=access-grant.d.ts.map

package/dist/access-grant.js

@@ -0,0 +1,62 @@
+import { ORG_CLAIM } from "@headless-lms/core/identity";
+import { ACCESS_SCOPES, isAccessScope } from "@headless-lms/core/organizations";
+import { parseAccessTokenAuthorization } from "better-auth/oauth2";
+//#region src/access-grant.ts
+function accessTokenAuthorization(header) {
+	if (typeof header !== "string") return null;
+	const authorization = parseAccessTokenAuthorization(header);
+	if (!authorization?.token || authorization.scheme === "Unknown") return null;
+	return authorization;
+}
+function isCompactJws(token) {
+	const parts = token.split(".");
+	return parts.length === 3 && parts.every((part) => part.length > 0);
+}
+function grantFromClaims(claims) {
+	const userId = claims.sub;
+	const clientId = claims.client_id ?? claims.azp;
+	const orgId = claims[ORG_CLAIM];
+	if (typeof userId !== "string" || typeof clientId !== "string" || typeof orgId !== "string") return null;
+	return {
+		userId,
+		clientId,
+		orgId,
+		scopes: typeof claims.scope === "string" ? claims.scope.split(" ").filter(isAccessScope) : []
+	};
+}
+async function needsOrgChoice(activeOrgId, memberOrgIds) {
+	if (activeOrgId === null) return true;
+	return !(await memberOrgIds()).includes(activeOrgId);
+}
+async function consentOrgId(activeOrgId, memberOrgIds) {
+	return activeOrgId !== null && !await needsOrgChoice(activeOrgId, memberOrgIds) ? activeOrgId : null;
+}
+function orgIdFromMetadata(metadata) {
+	let value = metadata;
+	if (typeof value === "string") try {
+		value = JSON.parse(value);
+	} catch {
+		return null;
+	}
+	const orgId = value?.organizationId;
+	return typeof orgId === "string" ? orgId : null;
+}
+function scopesToPermissions(scopes) {
+	const permissions = {};
+	for (const scope of new Set(scopes.filter(isAccessScope))) {
+		const separator = scope.indexOf(":");
+		const resource = scope.slice(0, separator);
+		permissions[resource] = [...permissions[resource] ?? [], scope.slice(separator + 1)];
+	}
+	return permissions;
+}
+function permissionsToScopes(permissions) {
+	if (permissions === null || typeof permissions !== "object") return [];
+	const granted = /* @__PURE__ */ new Set();
+	for (const [resource, actions] of Object.entries(permissions)) if (Array.isArray(actions)) for (const action of actions) granted.add(`${resource}:${String(action)}`);
+	return ACCESS_SCOPES.filter((scope) => granted.has(scope));
+}
+//#endregion
+export { accessTokenAuthorization, consentOrgId, grantFromClaims, isCompactJws, needsOrgChoice, orgIdFromMetadata, permissionsToScopes, scopesToPermissions };
+
+//# sourceMappingURL=access-grant.js.map

package/dist/access-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-grant.js","names":[],"sources":["../src/access-grant.ts"],"sourcesContent":["import type { AccessGrant } from \"@headless-lms/core/types\";\nimport { ORG_CLAIM } from \"@headless-lms/core/identity\";\nimport { ACCESS_SCOPES, type AccessScope, isAccessScope } from \"@headless-lms/core/organizations\";\nimport { type AccessTokenAuthorization, parseAccessTokenAuthorization } from \"better-auth/oauth2\";\n\nexport function accessTokenAuthorization(\n  header: string | string[] | undefined,\n): AccessTokenAuthorization | null {\n  if (typeof header !== \"string\") {\n    return null;\n  }\n  const authorization = parseAccessTokenAuthorization(header);\n  if (!authorization?.token || authorization.scheme === \"Unknown\") {\n    return null;\n  }\n  return authorization;\n}\n\nexport function isCompactJws(token: string): boolean {\n  const parts = token.split(\".\");\n  return parts.length === 3 && parts.every((part) => part.length > 0);\n}\n\nexport function grantFromClaims(claims: Record<string, unknown>): AccessGrant | null {\n  const userId = claims.sub;\n  const clientId = claims.client_id ?? claims.azp;\n  const orgId = claims[ORG_CLAIM];\n  if (typeof userId !== \"string\" || typeof clientId !== \"string\" || typeof orgId !== \"string\") {\n    return null;\n  }\n  const scopes =\n    typeof claims.scope === \"string\" ? claims.scope.split(\" \").filter(isAccessScope) : [];\n  return { userId, clientId, orgId, scopes };\n}\n\nexport async function needsOrgChoice(\n  activeOrgId: string | null,\n  memberOrgIds: () => Promise<readonly string[]>,\n): Promise<boolean> {\n  if (activeOrgId === null) {\n    return true;\n  }\n  return !(await memberOrgIds()).includes(activeOrgId);\n}\n\nexport async function consentOrgId(\n  activeOrgId: string | null,\n  memberOrgIds: () => Promise<readonly string[]>,\n): Promise<string | null> {\n  return activeOrgId !== null && !(await needsOrgChoice(activeOrgId, memberOrgIds))\n    ? activeOrgId\n    : null;\n}\n\nexport function orgIdFromMetadata(metadata: unknown): string | null {\n  let value = metadata;\n  if (typeof value === \"string\") {\n    try {\n      value = JSON.parse(value);\n    } catch {\n      return null;\n    }\n  }\n  const orgId = (value as { organizationId?: unknown } | null)?.organizationId;\n  return typeof orgId === \"string\" ? orgId : null;\n}\n\nexport function scopesToPermissions(scopes: string[]): Record<string, string[]> {\n  const permissions: Record<string, string[]> = {};\n  for (const scope of new Set(scopes.filter(isAccessScope))) {\n    const separator = scope.indexOf(\":\");\n    const resource = scope.slice(0, separator);\n    permissions[resource] = [...(permissions[resource] ?? []), scope.slice(separator + 1)];\n  }\n  return permissions;\n}\n\nexport function permissionsToScopes(permissions: unknown): AccessScope[] {\n  if (permissions === null || typeof permissions !== \"object\") {\n    return [];\n  }\n  const granted = new Set<string>();\n  for (const [resource, actions] of Object.entries(permissions)) {\n    if (Array.isArray(actions)) {\n      for (const action of actions) {\n        granted.add(`${resource}:${String(action)}`);\n      }\n    }\n  }\n  return ACCESS_SCOPES.filter((scope) => granted.has(scope));\n}\n"],"mappings":";;;;AAKA,SAAgB,yBACd,QACiC;CACjC,IAAI,OAAO,WAAW,UACpB,OAAO;CAET,MAAM,gBAAgB,8BAA8B,MAAM;CAC1D,IAAI,CAAC,eAAe,SAAS,cAAc,WAAW,WACpD,OAAO;CAET,OAAO;AACT;AAEA,SAAgB,aAAa,OAAwB;CACnD,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,OAAO,MAAM,WAAW,KAAK,MAAM,OAAO,SAAS,KAAK,SAAS,CAAC;AACpE;AAEA,SAAgB,gBAAgB,QAAqD;CACnF,MAAM,SAAS,OAAO;CACtB,MAAM,WAAW,OAAO,aAAa,OAAO;CAC5C,MAAM,QAAQ,OAAO;CACrB,IAAI,OAAO,WAAW,YAAY,OAAO,aAAa,YAAY,OAAO,UAAU,UACjF,OAAO;CAIT,OAAO;EAAE;EAAQ;EAAU;EAAO,QADhC,OAAO,OAAO,UAAU,WAAW,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,aAAa,IAAI,CAAC;CAC7C;AAC3C;AAEA,eAAsB,eACpB,aACA,cACkB;CAClB,IAAI,gBAAgB,MAClB,OAAO;CAET,OAAO,EAAE,MAAM,aAAa,EAAA,CAAG,SAAS,WAAW;AACrD;AAEA,eAAsB,aACpB,aACA,cACwB;CACxB,OAAO,gBAAgB,QAAQ,CAAE,MAAM,eAAe,aAAa,YAAY,IAC3E,cACA;AACN;AAEA,SAAgB,kBAAkB,UAAkC;CAClE,IAAI,QAAQ;CACZ,IAAI,OAAO,UAAU,UACnB,IAAI;EACF,QAAQ,KAAK,MAAM,KAAK;CAC1B,QAAQ;EACN,OAAO;CACT;CAEF,MAAM,QAAS,OAA+C;CAC9D,OAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAAgB,oBAAoB,QAA4C;CAC9E,MAAM,cAAwC,CAAC;CAC/C,KAAK,MAAM,SAAS,IAAI,IAAI,OAAO,OAAO,aAAa,CAAC,GAAG;EACzD,MAAM,YAAY,MAAM,QAAQ,GAAG;EACnC,MAAM,WAAW,MAAM,MAAM,GAAG,SAAS;EACzC,YAAY,YAAY,CAAC,GAAI,YAAY,aAAa,CAAC,GAAI,MAAM,MAAM,YAAY,CAAC,CAAC;CACvF;CACA,OAAO;AACT;AAEA,SAAgB,oBAAoB,aAAqC;CACvE,IAAI,gBAAgB,QAAQ,OAAO,gBAAgB,UACjD,OAAO,CAAC;CAEV,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,WAAW,GAC1D,IAAI,MAAM,QAAQ,OAAO,GACvB,KAAK,MAAM,UAAU,SACnB,QAAQ,IAAI,GAAG,SAAS,GAAG,OAAO,MAAM,GAAG;CAIjD,OAAO,cAAc,QAAQ,UAAU,QAAQ,IAAI,KAAK,CAAC;AAC3D"}

package/dist/access.d.ts

@@ -2,6 +2,7 @@
 declare const statement: {
   readonly course: readonly ["create", "read", "update", "delete"];
   readonly progress: readonly ["view"];
+  readonly community: readonly ["moderate"];
   readonly organization: readonly ["update", "delete"];
   readonly member: readonly ["create", "update", "delete"];
   readonly invitation: readonly ["create", "cancel"];
@@ -12,6 +13,7 @@ declare const ac: {
   newRole<const TRoleStatements extends import("better-auth/plugins/access").Statements>(statements: import("better-auth/plugins/access").RoleInput<{
     readonly course: readonly ["create", "read", "update", "delete"];
     readonly progress: readonly ["view"];
+    readonly community: readonly ["moderate"];
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
     readonly invitation: readonly ["create", "cancel"];
@@ -20,6 +22,7 @@ declare const ac: {
   }, TRoleStatements>): import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<TRoleStatements>, {
     readonly course: readonly ["create", "read", "update", "delete"];
     readonly progress: readonly ["view"];
+    readonly community: readonly ["moderate"];
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
     readonly invitation: readonly ["create", "cancel"];
@@ -29,6 +32,7 @@ declare const ac: {
   statements: {
     readonly course: readonly ["create", "read", "update", "delete"];
     readonly progress: readonly ["view"];
+    readonly community: readonly ["moderate"];
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
     readonly invitation: readonly ["create", "cancel"];
@@ -40,6 +44,7 @@ declare const roles: {
   owner: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
     readonly course: ["create", "read", "update", "delete"];
     readonly progress: ["view"];
+    readonly community: ["moderate"];
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
     readonly invitation: readonly ["create", "cancel"];
@@ -48,6 +53,7 @@ declare const roles: {
   }>, {
     readonly course: readonly ["create", "read", "update", "delete"];
     readonly progress: readonly ["view"];
+    readonly community: readonly ["moderate"];
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
     readonly invitation: readonly ["create", "cancel"];
@@ -57,6 +63,7 @@ declare const roles: {
   admin: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
     readonly course: ["create", "read", "update", "delete"];
     readonly progress: ["view"];
+    readonly community: ["moderate"];
     readonly organization: readonly ["update"];
     readonly invitation: readonly ["create", "cancel"];
     readonly member: readonly ["create", "update", "delete"];
@@ -65,6 +72,7 @@ declare const roles: {
   }>, {
     readonly course: readonly ["create", "read", "update", "delete"];
     readonly progress: readonly ["view"];
+    readonly community: readonly ["moderate"];
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
     readonly invitation: readonly ["create", "cancel"];
@@ -74,9 +82,24 @@ declare const roles: {
   instructor: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
     readonly course: ["read", "update"];
     readonly progress: ["view"];
+    readonly community: ["moderate"];
   }>, {
     readonly course: readonly ["create", "read", "update", "delete"];
     readonly progress: readonly ["view"];
+    readonly community: readonly ["moderate"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+  }>;
+  moderator: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
+    readonly course: ["read"];
+    readonly community: ["moderate"];
+  }>, {
+    readonly course: readonly ["create", "read", "update", "delete"];
+    readonly progress: readonly ["view"];
+    readonly community: readonly ["moderate"];
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
     readonly invitation: readonly ["create", "cancel"];
@@ -88,6 +111,7 @@ declare const roles: {
   }>, {
     readonly course: readonly ["create", "read", "update", "delete"];
     readonly progress: readonly ["view"];
+    readonly community: readonly ["moderate"];
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
     readonly invitation: readonly ["create", "cancel"];

package/dist/access.js

@@ -9,7 +9,8 @@ const statement = {
 		"update",
 		"delete"
 	],
-	progress: ["view"]
+	progress: ["view"],
+	community: ["moderate"]
 };
 const ac = createAccessControl(statement);
 const roles = {
@@ -21,7 +22,8 @@ const roles = {
 			"update",
 			"delete"
 		],
-		progress: ["view"]
+		progress: ["view"],
+		community: ["moderate"]
 	}),
 	admin: ac.newRole({
 		...adminAc.statements,
@@ -31,11 +33,17 @@ const roles = {
 			"update",
 			"delete"
 		],
-		progress: ["view"]
+		progress: ["view"],
+		community: ["moderate"]
 	}),
 	instructor: ac.newRole({
 		course: ["read", "update"],
-		progress: ["view"]
+		progress: ["view"],
+		community: ["moderate"]
+	}),
+	moderator: ac.newRole({
+		course: ["read"],
+		community: ["moderate"]
 	}),
 	student: ac.newRole({ course: ["read"] })
 };

package/dist/access.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.js","names":[],"sources":["../src/access.ts"],"sourcesContent":["// Better Auth org-plugin access control. Better Auth is the system of record for\n// roles; these four roles mirror the domain Role union (core/organizations/roles).\nimport { createAccessControl } from 'better-auth/plugins/access';\nimport { defaultStatements, ownerAc, adminAc } from 'better-auth/plugins/organization/access';\n\nexport const statement = {\n  ...defaultStatements,\n  course: ['create', 'read', 'update', 'delete'],\n  progress: ['view'],\n} as const;\n\nconst ac = createAccessControl(statement);\n\nexport const roles = {\n  owner: ac.newRole({\n    ...ownerAc.statements,\n    course: ['create', 'read', 'update', 'delete'],\n    progress: ['view'],\n  }),\n  admin: ac.newRole({\n    ...adminAc.statements,\n    course: ['create', 'read', 'update', 'delete'],\n    progress: ['view'],\n  }),\n  instructor: ac.newRole({\n    course: ['read', 'update'],\n    progress: ['view'],\n  }),\n  student: ac.newRole({\n    course: ['read'],\n  }),\n};\n\nexport { ac };\n"],"mappings":";;;AAKA,MAAa,YAAY;CACvB,GAAG;CACH,QAAQ;EAAC;EAAU;EAAQ;EAAU;CAAQ;CAC7C,UAAU,CAAC,MAAM;AACnB;AAEA,MAAM,KAAK,oBAAoB,SAAS;AAExC,MAAa,QAAQ;CACnB,OAAO,GAAG,QAAQ;EAChB,GAAG,QAAQ;EACX,QAAQ;GAAC;GAAU;GAAQ;GAAU;EAAQ;EAC7C,UAAU,CAAC,MAAM;CACnB,CAAC;CACD,OAAO,GAAG,QAAQ;EAChB,GAAG,QAAQ;EACX,QAAQ;GAAC;GAAU;GAAQ;GAAU;EAAQ;EAC7C,UAAU,CAAC,MAAM;CACnB,CAAC;CACD,YAAY,GAAG,QAAQ;EACrB,QAAQ,CAAC,QAAQ,QAAQ;EACzB,UAAU,CAAC,MAAM;CACnB,CAAC;CACD,SAAS,GAAG,QAAQ,EAClB,QAAQ,CAAC,MAAM,EACjB,CAAC;AACH"}
+{"version":3,"file":"access.js","names":[],"sources":["../src/access.ts"],"sourcesContent":["// Better Auth org-plugin access control. Better Auth is the system of record for\n// roles; these roles mirror the domain Role union (core/organizations/roles).\nimport { createAccessControl } from \"better-auth/plugins/access\";\nimport { defaultStatements, ownerAc, adminAc } from \"better-auth/plugins/organization/access\";\n\nexport const statement = {\n  ...defaultStatements,\n  course: [\"create\", \"read\", \"update\", \"delete\"],\n  progress: [\"view\"],\n  community: [\"moderate\"],\n} as const;\n\nconst ac = createAccessControl(statement);\n\nexport const roles = {\n  owner: ac.newRole({\n    ...ownerAc.statements,\n    course: [\"create\", \"read\", \"update\", \"delete\"],\n    progress: [\"view\"],\n    community: [\"moderate\"],\n  }),\n  admin: ac.newRole({\n    ...adminAc.statements,\n    course: [\"create\", \"read\", \"update\", \"delete\"],\n    progress: [\"view\"],\n    community: [\"moderate\"],\n  }),\n  instructor: ac.newRole({\n    course: [\"read\", \"update\"],\n    progress: [\"view\"],\n    community: [\"moderate\"],\n  }),\n  moderator: ac.newRole({\n    course: [\"read\"],\n    community: [\"moderate\"],\n  }),\n  student: ac.newRole({\n    course: [\"read\"],\n  }),\n};\n\nexport { ac };\n"],"mappings":";;;AAKA,MAAa,YAAY;CACvB,GAAG;CACH,QAAQ;EAAC;EAAU;EAAQ;EAAU;CAAQ;CAC7C,UAAU,CAAC,MAAM;CACjB,WAAW,CAAC,UAAU;AACxB;AAEA,MAAM,KAAK,oBAAoB,SAAS;AAExC,MAAa,QAAQ;CACnB,OAAO,GAAG,QAAQ;EAChB,GAAG,QAAQ;EACX,QAAQ;GAAC;GAAU;GAAQ;GAAU;EAAQ;EAC7C,UAAU,CAAC,MAAM;EACjB,WAAW,CAAC,UAAU;CACxB,CAAC;CACD,OAAO,GAAG,QAAQ;EAChB,GAAG,QAAQ;EACX,QAAQ;GAAC;GAAU;GAAQ;GAAU;EAAQ;EAC7C,UAAU,CAAC,MAAM;EACjB,WAAW,CAAC,UAAU;CACxB,CAAC;CACD,YAAY,GAAG,QAAQ;EACrB,QAAQ,CAAC,QAAQ,QAAQ;EACzB,UAAU,CAAC,MAAM;EACjB,WAAW,CAAC,UAAU;CACxB,CAAC;CACD,WAAW,GAAG,QAAQ;EACpB,QAAQ,CAAC,MAAM;EACf,WAAW,CAAC,UAAU;CACxB,CAAC;CACD,SAAS,GAAG,QAAQ,EAClB,QAAQ,CAAC,MAAM,EACjB,CAAC;AACH"}