@headless-lms/adapter-auth 0.3.1 → 0.4.0

package/dist/access-grant.d.ts

@@ -1,4 +1,3 @@
-import { AccessScope } from "@headless-lms/core/organizations";
 import { AccessTokenAuthorization } from "better-auth/oauth2";
 import { AccessGrant } from "@headless-lms/core/types";
 //#region src/access-grant.d.ts
@@ -8,8 +7,7 @@ declare function grantFromClaims(claims: Record<string, unknown>): AccessGrant |
 declare function needsOrgChoice(activeOrgId: string | null, memberOrgIds: () => Promise<readonly string[]>): Promise<boolean>;
 declare function consentOrgId(activeOrgId: string | null, memberOrgIds: () => Promise<readonly string[]>): Promise<string | null>;
 declare function orgIdFromMetadata(metadata: unknown): string | null;
-declare function scopesToPermissions(scopes: string[]): Record<string, string[]>;
-declare function permissionsToScopes(permissions: unknown): AccessScope[];
+declare function roleFromMetadata(metadata: unknown): string | null;
 //#endregion
-export { accessTokenAuthorization, consentOrgId, grantFromClaims, isCompactJws, needsOrgChoice, orgIdFromMetadata, permissionsToScopes, scopesToPermissions };
+export { accessTokenAuthorization, consentOrgId, grantFromClaims, isCompactJws, needsOrgChoice, orgIdFromMetadata, roleFromMetadata };
 //# sourceMappingURL=access-grant.d.ts.map

package/dist/access-grant.js

@@ -1,5 +1,5 @@
 import { ORG_CLAIM } from "@headless-lms/core/identity";
-import { ACCESS_SCOPES, isAccessScope } from "@headless-lms/core/organizations";
+import { isPermission } from "@headless-lms/core/organizations";
 import { parseAccessTokenAuthorization } from "better-auth/oauth2";
 //#region src/access-grant.ts
 function accessTokenAuthorization(header) {
@@ -21,7 +21,7 @@ function grantFromClaims(claims) {
 		userId,
 		clientId,
 		orgId,
-		scopes: typeof claims.scope === "string" ? claims.scope.split(" ").filter(isAccessScope) : []
+		limit: { scopes: typeof claims.scope === "string" ? claims.scope.split(" ").filter(isPermission) : [] }
 	};
 }
 async function needsOrgChoice(activeOrgId, memberOrgIds) {
@@ -31,32 +31,23 @@ async function needsOrgChoice(activeOrgId, memberOrgIds) {
 async function consentOrgId(activeOrgId, memberOrgIds) {
 	return activeOrgId !== null && !await needsOrgChoice(activeOrgId, memberOrgIds) ? activeOrgId : null;
 }
-function orgIdFromMetadata(metadata) {
+function metadataField(metadata, field) {
 	let value = metadata;
 	if (typeof value === "string") try {
 		value = JSON.parse(value);
 	} catch {
 		return null;
 	}
-	const orgId = value?.organizationId;
-	return typeof orgId === "string" ? orgId : null;
-}
-function scopesToPermissions(scopes) {
-	const permissions = {};
-	for (const scope of new Set(scopes.filter(isAccessScope))) {
-		const separator = scope.indexOf(":");
-		const resource = scope.slice(0, separator);
-		permissions[resource] = [...permissions[resource] ?? [], scope.slice(separator + 1)];
-	}
-	return permissions;
+	const found = value?.[field];
+	return typeof found === "string" && found.length > 0 ? found : null;
+}
+function orgIdFromMetadata(metadata) {
+	return metadataField(metadata, "organizationId");
 }
-function permissionsToScopes(permissions) {
-	if (permissions === null || typeof permissions !== "object") return [];
-	const granted = /* @__PURE__ */ new Set();
-	for (const [resource, actions] of Object.entries(permissions)) if (Array.isArray(actions)) for (const action of actions) granted.add(`${resource}:${String(action)}`);
-	return ACCESS_SCOPES.filter((scope) => granted.has(scope));
+function roleFromMetadata(metadata) {
+	return metadataField(metadata, "role");
 }
 //#endregion
-export { accessTokenAuthorization, consentOrgId, grantFromClaims, isCompactJws, needsOrgChoice, orgIdFromMetadata, permissionsToScopes, scopesToPermissions };
+export { accessTokenAuthorization, consentOrgId, grantFromClaims, isCompactJws, needsOrgChoice, orgIdFromMetadata, roleFromMetadata };
 
 //# sourceMappingURL=access-grant.js.map

package/dist/access-grant.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-grant.js","names":[],"sources":["../src/access-grant.ts"],"sourcesContent":["import type { AccessGrant } from \"@headless-lms/core/types\";\nimport { ORG_CLAIM } from \"@headless-lms/core/identity\";\nimport { ACCESS_SCOPES, type AccessScope, isAccessScope } from \"@headless-lms/core/organizations\";\nimport { type AccessTokenAuthorization, parseAccessTokenAuthorization } from \"better-auth/oauth2\";\n\nexport function accessTokenAuthorization(\n  header: string | string[] | undefined,\n): AccessTokenAuthorization | null {\n  if (typeof header !== \"string\") {\n    return null;\n  }\n  const authorization = parseAccessTokenAuthorization(header);\n  if (!authorization?.token || authorization.scheme === \"Unknown\") {\n    return null;\n  }\n  return authorization;\n}\n\nexport function isCompactJws(token: string): boolean {\n  const parts = token.split(\".\");\n  return parts.length === 3 && parts.every((part) => part.length > 0);\n}\n\nexport function grantFromClaims(claims: Record<string, unknown>): AccessGrant | null {\n  const userId = claims.sub;\n  const clientId = claims.client_id ?? claims.azp;\n  const orgId = claims[ORG_CLAIM];\n  if (typeof userId !== \"string\" || typeof clientId !== \"string\" || typeof orgId !== \"string\") {\n    return null;\n  }\n  const scopes =\n    typeof claims.scope === \"string\" ? claims.scope.split(\" \").filter(isAccessScope) : [];\n  return { userId, clientId, orgId, scopes };\n}\n\nexport async function needsOrgChoice(\n  activeOrgId: string | null,\n  memberOrgIds: () => Promise<readonly string[]>,\n): Promise<boolean> {\n  if (activeOrgId === null) {\n    return true;\n  }\n  return !(await memberOrgIds()).includes(activeOrgId);\n}\n\nexport async function consentOrgId(\n  activeOrgId: string | null,\n  memberOrgIds: () => Promise<readonly string[]>,\n): Promise<string | null> {\n  return activeOrgId !== null && !(await needsOrgChoice(activeOrgId, memberOrgIds))\n    ? activeOrgId\n    : null;\n}\n\nexport function orgIdFromMetadata(metadata: unknown): string | null {\n  let value = metadata;\n  if (typeof value === \"string\") {\n    try {\n      value = JSON.parse(value);\n    } catch {\n      return null;\n    }\n  }\n  const orgId = (value as { organizationId?: unknown } | null)?.organizationId;\n  return typeof orgId === \"string\" ? orgId : null;\n}\n\nexport function scopesToPermissions(scopes: string[]): Record<string, string[]> {\n  const permissions: Record<string, string[]> = {};\n  for (const scope of new Set(scopes.filter(isAccessScope))) {\n    const separator = scope.indexOf(\":\");\n    const resource = scope.slice(0, separator);\n    permissions[resource] = [...(permissions[resource] ?? []), scope.slice(separator + 1)];\n  }\n  return permissions;\n}\n\nexport function permissionsToScopes(permissions: unknown): AccessScope[] {\n  if (permissions === null || typeof permissions !== \"object\") {\n    return [];\n  }\n  const granted = new Set<string>();\n  for (const [resource, actions] of Object.entries(permissions)) {\n    if (Array.isArray(actions)) {\n      for (const action of actions) {\n        granted.add(`${resource}:${String(action)}`);\n      }\n    }\n  }\n  return ACCESS_SCOPES.filter((scope) => granted.has(scope));\n}\n"],"mappings":";;;;AAKA,SAAgB,yBACd,QACiC;CACjC,IAAI,OAAO,WAAW,UACpB,OAAO;CAET,MAAM,gBAAgB,8BAA8B,MAAM;CAC1D,IAAI,CAAC,eAAe,SAAS,cAAc,WAAW,WACpD,OAAO;CAET,OAAO;AACT;AAEA,SAAgB,aAAa,OAAwB;CACnD,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,OAAO,MAAM,WAAW,KAAK,MAAM,OAAO,SAAS,KAAK,SAAS,CAAC;AACpE;AAEA,SAAgB,gBAAgB,QAAqD;CACnF,MAAM,SAAS,OAAO;CACtB,MAAM,WAAW,OAAO,aAAa,OAAO;CAC5C,MAAM,QAAQ,OAAO;CACrB,IAAI,OAAO,WAAW,YAAY,OAAO,aAAa,YAAY,OAAO,UAAU,UACjF,OAAO;CAIT,OAAO;EAAE;EAAQ;EAAU;EAAO,QADhC,OAAO,OAAO,UAAU,WAAW,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,aAAa,IAAI,CAAC;CAC7C;AAC3C;AAEA,eAAsB,eACpB,aACA,cACkB;CAClB,IAAI,gBAAgB,MAClB,OAAO;CAET,OAAO,EAAE,MAAM,aAAa,EAAA,CAAG,SAAS,WAAW;AACrD;AAEA,eAAsB,aACpB,aACA,cACwB;CACxB,OAAO,gBAAgB,QAAQ,CAAE,MAAM,eAAe,aAAa,YAAY,IAC3E,cACA;AACN;AAEA,SAAgB,kBAAkB,UAAkC;CAClE,IAAI,QAAQ;CACZ,IAAI,OAAO,UAAU,UACnB,IAAI;EACF,QAAQ,KAAK,MAAM,KAAK;CAC1B,QAAQ;EACN,OAAO;CACT;CAEF,MAAM,QAAS,OAA+C;CAC9D,OAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAAgB,oBAAoB,QAA4C;CAC9E,MAAM,cAAwC,CAAC;CAC/C,KAAK,MAAM,SAAS,IAAI,IAAI,OAAO,OAAO,aAAa,CAAC,GAAG;EACzD,MAAM,YAAY,MAAM,QAAQ,GAAG;EACnC,MAAM,WAAW,MAAM,MAAM,GAAG,SAAS;EACzC,YAAY,YAAY,CAAC,GAAI,YAAY,aAAa,CAAC,GAAI,MAAM,MAAM,YAAY,CAAC,CAAC;CACvF;CACA,OAAO;AACT;AAEA,SAAgB,oBAAoB,aAAqC;CACvE,IAAI,gBAAgB,QAAQ,OAAO,gBAAgB,UACjD,OAAO,CAAC;CAEV,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,WAAW,GAC1D,IAAI,MAAM,QAAQ,OAAO,GACvB,KAAK,MAAM,UAAU,SACnB,QAAQ,IAAI,GAAG,SAAS,GAAG,OAAO,MAAM,GAAG;CAIjD,OAAO,cAAc,QAAQ,UAAU,QAAQ,IAAI,KAAK,CAAC;AAC3D"}
+{"version":3,"file":"access-grant.js","names":[],"sources":["../src/access-grant.ts"],"sourcesContent":["import type { AccessGrant } from \"@headless-lms/core/types\";\nimport { ORG_CLAIM } from \"@headless-lms/core/identity\";\nimport { isPermission } from \"@headless-lms/core/organizations\";\nimport { type AccessTokenAuthorization, parseAccessTokenAuthorization } from \"better-auth/oauth2\";\n\nexport function accessTokenAuthorization(\n  header: string | string[] | undefined,\n): AccessTokenAuthorization | null {\n  if (typeof header !== \"string\") {\n    return null;\n  }\n  const authorization = parseAccessTokenAuthorization(header);\n  if (!authorization?.token || authorization.scheme === \"Unknown\") {\n    return null;\n  }\n  return authorization;\n}\n\nexport function isCompactJws(token: string): boolean {\n  const parts = token.split(\".\");\n  return parts.length === 3 && parts.every((part) => part.length > 0);\n}\n\nexport function grantFromClaims(claims: Record<string, unknown>): AccessGrant | null {\n  const userId = claims.sub;\n  const clientId = claims.client_id ?? claims.azp;\n  const orgId = claims[ORG_CLAIM];\n  if (typeof userId !== \"string\" || typeof clientId !== \"string\" || typeof orgId !== \"string\") {\n    return null;\n  }\n  const scopes =\n    typeof claims.scope === \"string\" ? claims.scope.split(\" \").filter(isPermission) : [];\n  return { userId, clientId, orgId, limit: { scopes } };\n}\n\nexport async function needsOrgChoice(\n  activeOrgId: string | null,\n  memberOrgIds: () => Promise<readonly string[]>,\n): Promise<boolean> {\n  if (activeOrgId === null) {\n    return true;\n  }\n  return !(await memberOrgIds()).includes(activeOrgId);\n}\n\nexport async function consentOrgId(\n  activeOrgId: string | null,\n  memberOrgIds: () => Promise<readonly string[]>,\n): Promise<string | null> {\n  return activeOrgId !== null && !(await needsOrgChoice(activeOrgId, memberOrgIds))\n    ? activeOrgId\n    : null;\n}\n\nfunction metadataField(metadata: unknown, field: string): string | null {\n  let value = metadata;\n  if (typeof value === \"string\") {\n    try {\n      value = JSON.parse(value);\n    } catch {\n      return null;\n    }\n  }\n  const found = (value as Record<string, unknown> | null)?.[field];\n  return typeof found === \"string\" && found.length > 0 ? found : null;\n}\n\nexport function orgIdFromMetadata(metadata: unknown): string | null {\n  return metadataField(metadata, \"organizationId\");\n}\n\nexport function roleFromMetadata(metadata: unknown): string | null {\n  return metadataField(metadata, \"role\");\n}\n"],"mappings":";;;;AAKA,SAAgB,yBACd,QACiC;CACjC,IAAI,OAAO,WAAW,UACpB,OAAO;CAET,MAAM,gBAAgB,8BAA8B,MAAM;CAC1D,IAAI,CAAC,eAAe,SAAS,cAAc,WAAW,WACpD,OAAO;CAET,OAAO;AACT;AAEA,SAAgB,aAAa,OAAwB;CACnD,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,OAAO,MAAM,WAAW,KAAK,MAAM,OAAO,SAAS,KAAK,SAAS,CAAC;AACpE;AAEA,SAAgB,gBAAgB,QAAqD;CACnF,MAAM,SAAS,OAAO;CACtB,MAAM,WAAW,OAAO,aAAa,OAAO;CAC5C,MAAM,QAAQ,OAAO;CACrB,IAAI,OAAO,WAAW,YAAY,OAAO,aAAa,YAAY,OAAO,UAAU,UACjF,OAAO;CAIT,OAAO;EAAE;EAAQ;EAAU;EAAO,OAAO,EAAE,QADzC,OAAO,OAAO,UAAU,WAAW,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,YAAY,IAAI,CAAC,EACnC;CAAE;AACtD;AAEA,eAAsB,eACpB,aACA,cACkB;CAClB,IAAI,gBAAgB,MAClB,OAAO;CAET,OAAO,EAAE,MAAM,aAAa,EAAA,CAAG,SAAS,WAAW;AACrD;AAEA,eAAsB,aACpB,aACA,cACwB;CACxB,OAAO,gBAAgB,QAAQ,CAAE,MAAM,eAAe,aAAa,YAAY,IAC3E,cACA;AACN;AAEA,SAAS,cAAc,UAAmB,OAA8B;CACtE,IAAI,QAAQ;CACZ,IAAI,OAAO,UAAU,UACnB,IAAI;EACF,QAAQ,KAAK,MAAM,KAAK;CAC1B,QAAQ;EACN,OAAO;CACT;CAEF,MAAM,QAAS,QAA2C;CAC1D,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,SAAgB,kBAAkB,UAAkC;CAClE,OAAO,cAAc,UAAU,gBAAgB;AACjD;AAEA,SAAgB,iBAAiB,UAAkC;CACjE,OAAO,cAAc,UAAU,MAAM;AACvC"}

package/dist/access.d.ts

@@ -1,8 +1,5 @@
 //#region src/access.d.ts
 declare const statement: {
-  readonly course: readonly ["create", "read", "update", "delete"];
-  readonly progress: readonly ["view"];
-  readonly community: readonly ["moderate"];
   readonly organization: readonly ["update", "delete"];
   readonly member: readonly ["create", "update", "delete"];
   readonly invitation: readonly ["create", "cancel"];
@@ -11,18 +8,12 @@ declare const statement: {
 };
 declare const ac: {
   newRole<const TRoleStatements extends import("better-auth/plugins/access").Statements>(statements: import("better-auth/plugins/access").RoleInput<{
-    readonly course: readonly ["create", "read", "update", "delete"];
-    readonly progress: readonly ["view"];
-    readonly community: readonly ["moderate"];
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
     readonly invitation: readonly ["create", "cancel"];
     readonly team: readonly ["create", "update", "delete"];
     readonly ac: readonly ["create", "read", "update", "delete"];
   }, TRoleStatements>): import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<TRoleStatements>, {
-    readonly course: readonly ["create", "read", "update", "delete"];
-    readonly progress: readonly ["view"];
-    readonly community: readonly ["moderate"];
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
     readonly invitation: readonly ["create", "cancel"];
@@ -30,9 +21,6 @@ declare const ac: {
     readonly ac: readonly ["create", "read", "update", "delete"];
   }>;
   statements: {
-    readonly course: readonly ["create", "read", "update", "delete"];
-    readonly progress: readonly ["view"];
-    readonly community: readonly ["moderate"];
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
     readonly invitation: readonly ["create", "cancel"];
@@ -40,78 +28,29 @@ declare const ac: {
     readonly ac: readonly ["create", "read", "update", "delete"];
   };
 };
+declare const OWNER_MEMBERSHIP = "owner";
+declare const PARTICIPANT_MEMBERSHIP = "participant";
 declare const roles: {
-  owner: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
-    readonly course: ["create", "read", "update", "delete"];
-    readonly progress: ["view"];
-    readonly community: ["moderate"];
-    readonly organization: readonly ["update", "delete"];
-    readonly member: readonly ["create", "update", "delete"];
-    readonly invitation: readonly ["create", "cancel"];
-    readonly team: readonly ["create", "update", "delete"];
-    readonly ac: readonly ["create", "read", "update", "delete"];
-  }>, {
-    readonly course: readonly ["create", "read", "update", "delete"];
-    readonly progress: readonly ["view"];
-    readonly community: readonly ["moderate"];
-    readonly organization: readonly ["update", "delete"];
-    readonly member: readonly ["create", "update", "delete"];
-    readonly invitation: readonly ["create", "cancel"];
-    readonly team: readonly ["create", "update", "delete"];
-    readonly ac: readonly ["create", "read", "update", "delete"];
-  }>;
-  admin: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
-    readonly course: ["create", "read", "update", "delete"];
-    readonly progress: ["view"];
-    readonly community: ["moderate"];
-    readonly organization: readonly ["update"];
-    readonly invitation: readonly ["create", "cancel"];
-    readonly member: readonly ["create", "update", "delete"];
-    readonly team: readonly ["create", "update", "delete"];
-    readonly ac: readonly ["create", "read", "update", "delete"];
-  }>, {
-    readonly course: readonly ["create", "read", "update", "delete"];
-    readonly progress: readonly ["view"];
-    readonly community: readonly ["moderate"];
-    readonly organization: readonly ["update", "delete"];
-    readonly member: readonly ["create", "update", "delete"];
-    readonly invitation: readonly ["create", "cancel"];
-    readonly team: readonly ["create", "update", "delete"];
-    readonly ac: readonly ["create", "read", "update", "delete"];
-  }>;
-  instructor: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
-    readonly course: ["read", "update"];
-    readonly progress: ["view"];
-    readonly community: ["moderate"];
-  }>, {
-    readonly course: readonly ["create", "read", "update", "delete"];
-    readonly progress: readonly ["view"];
-    readonly community: readonly ["moderate"];
-    readonly organization: readonly ["update", "delete"];
-    readonly member: readonly ["create", "update", "delete"];
-    readonly invitation: readonly ["create", "cancel"];
-    readonly team: readonly ["create", "update", "delete"];
-    readonly ac: readonly ["create", "read", "update", "delete"];
-  }>;
-  moderator: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
-    readonly course: ["read"];
-    readonly community: ["moderate"];
-  }>, {
-    readonly course: readonly ["create", "read", "update", "delete"];
-    readonly progress: readonly ["view"];
-    readonly community: readonly ["moderate"];
+  owner: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<import("better-auth/plugins/access").ExactRoleStatements<{
+    readonly organization: ["update", "delete"];
+    readonly member: ["create", "update", "delete"];
+    readonly invitation: ["create", "cancel"];
+    readonly team: ["create", "update", "delete"];
+    readonly ac: ["create", "read", "update", "delete"];
+  }>>, {
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
     readonly invitation: readonly ["create", "cancel"];
     readonly team: readonly ["create", "update", "delete"];
     readonly ac: readonly ["create", "read", "update", "delete"];
   }>;
-  student: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
-    readonly course: ["read"];
-  }>, {
-    readonly course: readonly ["create", "read", "update", "delete"];
-    readonly progress: readonly ["view"];
-    readonly community: readonly ["moderate"];
+  participant: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<import("better-auth/plugins/access").ExactRoleStatements<{
+    readonly organization: [];
+    readonly member: [];
+    readonly invitation: [];
+    readonly team: [];
+    readonly ac: ["read"];
+  }>>, {
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
     readonly invitation: readonly ["create", "cancel"];
@@ -120,5 +59,5 @@ declare const roles: {
   }>;
 };
 //#endregion
-export { ac, roles, statement };
+export { OWNER_MEMBERSHIP, PARTICIPANT_MEMBERSHIP, ac, roles, statement };
 //# sourceMappingURL=access.d.ts.map

package/dist/access.js

@@ -1,53 +1,15 @@
 import { createAccessControl } from "better-auth/plugins/access";
-import { adminAc, defaultStatements, ownerAc } from "better-auth/plugins/organization/access";
+import { defaultStatements, memberAc, ownerAc } from "better-auth/plugins/organization/access";
 //#region src/access.ts
-const statement = {
-	...defaultStatements,
-	course: [
-		"create",
-		"read",
-		"update",
-		"delete"
-	],
-	progress: ["view"],
-	community: ["moderate"]
-};
+const statement = { ...defaultStatements };
 const ac = createAccessControl(statement);
+const OWNER_MEMBERSHIP = "owner";
+const PARTICIPANT_MEMBERSHIP = "participant";
 const roles = {
-	owner: ac.newRole({
-		...ownerAc.statements,
-		course: [
-			"create",
-			"read",
-			"update",
-			"delete"
-		],
-		progress: ["view"],
-		community: ["moderate"]
-	}),
-	admin: ac.newRole({
-		...adminAc.statements,
-		course: [
-			"create",
-			"read",
-			"update",
-			"delete"
-		],
-		progress: ["view"],
-		community: ["moderate"]
-	}),
-	instructor: ac.newRole({
-		course: ["read", "update"],
-		progress: ["view"],
-		community: ["moderate"]
-	}),
-	moderator: ac.newRole({
-		course: ["read"],
-		community: ["moderate"]
-	}),
-	student: ac.newRole({ course: ["read"] })
+	[OWNER_MEMBERSHIP]: ac.newRole(ownerAc.statements),
+	[PARTICIPANT_MEMBERSHIP]: ac.newRole(memberAc.statements)
 };
 //#endregion
-export { ac, roles, statement };
+export { OWNER_MEMBERSHIP, PARTICIPANT_MEMBERSHIP, ac, roles, statement };
 
 //# sourceMappingURL=access.js.map

package/dist/access.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.js","names":[],"sources":["../src/access.ts"],"sourcesContent":["// Better Auth org-plugin access control. Better Auth is the system of record for\n// roles; these roles mirror the domain Role union (core/organizations/roles).\nimport { createAccessControl } from \"better-auth/plugins/access\";\nimport { defaultStatements, ownerAc, adminAc } from \"better-auth/plugins/organization/access\";\n\nexport const statement = {\n  ...defaultStatements,\n  course: [\"create\", \"read\", \"update\", \"delete\"],\n  progress: [\"view\"],\n  community: [\"moderate\"],\n} as const;\n\nconst ac = createAccessControl(statement);\n\nexport const roles = {\n  owner: ac.newRole({\n    ...ownerAc.statements,\n    course: [\"create\", \"read\", \"update\", \"delete\"],\n    progress: [\"view\"],\n    community: [\"moderate\"],\n  }),\n  admin: ac.newRole({\n    ...adminAc.statements,\n    course: [\"create\", \"read\", \"update\", \"delete\"],\n    progress: [\"view\"],\n    community: [\"moderate\"],\n  }),\n  instructor: ac.newRole({\n    course: [\"read\", \"update\"],\n    progress: [\"view\"],\n    community: [\"moderate\"],\n  }),\n  moderator: ac.newRole({\n    course: [\"read\"],\n    community: [\"moderate\"],\n  }),\n  student: ac.newRole({\n    course: [\"read\"],\n  }),\n};\n\nexport { ac };\n"],"mappings":";;;AAKA,MAAa,YAAY;CACvB,GAAG;CACH,QAAQ;EAAC;EAAU;EAAQ;EAAU;CAAQ;CAC7C,UAAU,CAAC,MAAM;CACjB,WAAW,CAAC,UAAU;AACxB;AAEA,MAAM,KAAK,oBAAoB,SAAS;AAExC,MAAa,QAAQ;CACnB,OAAO,GAAG,QAAQ;EAChB,GAAG,QAAQ;EACX,QAAQ;GAAC;GAAU;GAAQ;GAAU;EAAQ;EAC7C,UAAU,CAAC,MAAM;EACjB,WAAW,CAAC,UAAU;CACxB,CAAC;CACD,OAAO,GAAG,QAAQ;EAChB,GAAG,QAAQ;EACX,QAAQ;GAAC;GAAU;GAAQ;GAAU;EAAQ;EAC7C,UAAU,CAAC,MAAM;EACjB,WAAW,CAAC,UAAU;CACxB,CAAC;CACD,YAAY,GAAG,QAAQ;EACrB,QAAQ,CAAC,QAAQ,QAAQ;EACzB,UAAU,CAAC,MAAM;EACjB,WAAW,CAAC,UAAU;CACxB,CAAC;CACD,WAAW,GAAG,QAAQ;EACpB,QAAQ,CAAC,MAAM;EACf,WAAW,CAAC,UAAU;CACxB,CAAC;CACD,SAAS,GAAG,QAAQ,EAClB,QAAQ,CAAC,MAAM,EACjB,CAAC;AACH"}
+{"version":3,"file":"access.js","names":[],"sources":["../src/access.ts"],"sourcesContent":["import { createAccessControl } from \"better-auth/plugins/access\";\nimport { defaultStatements, ownerAc, memberAc } from \"better-auth/plugins/organization/access\";\n\nexport const statement = { ...defaultStatements } as const;\n\nconst ac = createAccessControl(statement);\n\nexport const OWNER_MEMBERSHIP = \"owner\";\nexport const PARTICIPANT_MEMBERSHIP = \"participant\";\n\nexport const roles = {\n  [OWNER_MEMBERSHIP]: ac.newRole(ownerAc.statements),\n  [PARTICIPANT_MEMBERSHIP]: ac.newRole(memberAc.statements),\n};\n\nexport { ac };\n"],"mappings":";;;AAGA,MAAa,YAAY,EAAE,GAAG,kBAAkB;AAEhD,MAAM,KAAK,oBAAoB,SAAS;AAExC,MAAa,mBAAmB;AAChC,MAAa,yBAAyB;AAEtC,MAAa,QAAQ;EAClB,mBAAmB,GAAG,QAAQ,QAAQ,UAAU;EAChD,yBAAyB,GAAG,QAAQ,SAAS,UAAU;AAC1D"}