@hilbras/keystone 1.6.0 → 2.5.0

package/dist/repositories/mfaChallenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfaChallenge.d.ts","sourceRoot":"","sources":["../../src/repositories/mfaChallenge.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAElF;;;;;;GAMG;AACH,qBAAa,6BAA8B,YAAW,sBAAsB;IACpE,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAelE;IAEK,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAOzE;IAED;;;;OAIG;IACG,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAelF;IAEK,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CActE;IAEK,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAWvE;IAEK,aAAa,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAW9C;CACF"}

package/dist/repositories/mfaChallenge.js

@@ -0,0 +1,71 @@
+import { and, eq, gt, inArray, isNull, lt, lte, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { mfaChallenges } from "../db/schema.js";
+/**
+ * Durable storage for pre-authentication MFA challenges.
+ *
+ * Challenges are single-use: `consume` performs a conditional update so two
+ * concurrent verifications can never both complete, and only the stored hash of
+ * the challenge is persisted.
+ */
+export class DrizzleMfaChallengeRepository {
+    async create(input) {
+        const [created] = await db
+            .insert(mfaChallenges)
+            .values({
+            challengeHash: input.challengeHash,
+            userId: input.userId,
+            flow: input.flow,
+            clientId: input.clientId ?? null,
+            ipAddress: input.ipAddress ?? null,
+            userAgent: input.userAgent ?? null,
+            expiresAt: input.expiresAt,
+            maxAttempts: input.maxAttempts,
+        })
+            .returning();
+        return created;
+    }
+    async findByHash(challengeHash) {
+        const [found] = await db
+            .select()
+            .from(mfaChallenges)
+            .where(eq(mfaChallenges.challengeHash, challengeHash))
+            .limit(1);
+        return found;
+    }
+    /**
+     * Record a failed attempt only while the challenge is still active and below
+     * its attempt budget. Reaching the budget marks the challenge failed so it can
+     * never be used again.
+     */
+    async recordFailedAttempt(id, now) {
+        const rows = await db
+            .update(mfaChallenges)
+            .set({ attempts: sql `${mfaChallenges.attempts} + 1` })
+            .where(and(eq(mfaChallenges.id, id), eq(mfaChallenges.status, "requires_mfa"), isNull(mfaChallenges.consumedAt), gt(mfaChallenges.expiresAt, now), lt(mfaChallenges.attempts, mfaChallenges.maxAttempts)))
+            .returning();
+        return rows[0];
+    }
+    async consume(id, now) {
+        const rows = await db
+            .update(mfaChallenges)
+            .set({ status: "consumed", consumedAt: now })
+            .where(and(eq(mfaChallenges.id, id), eq(mfaChallenges.status, "requires_mfa"), isNull(mfaChallenges.consumedAt), gt(mfaChallenges.expiresAt, now)))
+            .returning();
+        return rows[0];
+    }
+    async invalidateUserChallenges(userId, now) {
+        await db
+            .update(mfaChallenges)
+            .set({ status: "failed", consumedAt: now })
+            .where(and(eq(mfaChallenges.userId, userId), eq(mfaChallenges.status, "requires_mfa"), isNull(mfaChallenges.consumedAt)));
+    }
+    async deleteExpired(now) {
+        const rows = await db
+            .delete(mfaChallenges)
+            .where(and(inArray(mfaChallenges.status, ["requires_mfa", "failed"]), lte(mfaChallenges.expiresAt, now)))
+            .returning({ id: mfaChallenges.id });
+        return rows.length;
+    }
+}
+//# sourceMappingURL=mfaChallenge.js.map

package/dist/repositories/mfaChallenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfaChallenge.js","sourceRoot":"","sources":["../../src/repositories/mfaChallenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,aAAa,EAAqB,MAAM,iBAAiB,CAAC;AAGnE;;;;;;GAMG;AACH,MAAM,OAAO,6BAA6B;IACxC,KAAK,CAAC,MAAM,CAAC,KAA8B;QACzC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,aAAa,CAAC;aACrB,MAAM,CAAC;YACN,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,aAAqB;QACpC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,EAAE;aACR,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;aACrD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,EAAU,EAAE,GAAS;QAC7C,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,aAAa,CAAC;aACrB,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAA,GAAG,aAAa,CAAC,QAAQ,MAAM,EAAE,CAAC;aACrD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,EACxB,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,EACxC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAChC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,EAChC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CACtD,CACF;aACA,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,GAAS;QACjC,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,aAAa,CAAC;aACrB,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;aAC5C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,EACxB,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,EACxC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAChC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CACjC,CACF;aACA,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,MAAc,EAAE,GAAS;QACtD,MAAM,EAAE;aACL,MAAM,CAAC,aAAa,CAAC;aACrB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;aAC1C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,EACxC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CACjC,CACF,CAAC;IACN,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAS;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,aAAa,CAAC;aACrB,KAAK,CACJ,GAAG,CACD,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,EACzD,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAClC,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}

package/dist/repositories/oidcConnection.d.ts

@@ -14,8 +14,8 @@ export type OidcConnectionListItem = {
 };
 export interface OidcConnectionRepository {
     listByOrgId(orgId: string): Promise<OidcConnectionListItem[]>;
-    findById(id: string): Promise<OidcConnection | undefined>;
-    findActiveById(id: string): Promise<OidcConnection | undefined>;
+    findActiveByIdAndOrgId(id: string, orgId: string): Promise<OidcConnection | undefined>;
+    updateClientSecret(id: string, clientSecret: string): Promise<boolean>;
     create(input: {
         orgId: string;
         name: string;
@@ -46,40 +46,24 @@ export declare class DrizzleOidcConnectionRepository implements OidcConnectionRe
         isActive: boolean;
         createdAt: Date;
     }[]>;
-    findById(id: string): Promise<{
+    findActiveByIdAndOrgId(id: string, orgId: string): Promise<{
         id: string;
-        name: string;
-        createdAt: Date;
-        updatedAt: Date;
         orgId: string;
-        clientId: string;
-        isActive: boolean;
-        scopes: string[];
-        attributeMapping: unknown;
+        name: string;
         issuer: string;
         authorizationEndpoint: string;
         tokenEndpoint: string;
         userinfoEndpoint: string | null;
         jwksUri: string | null;
-        clientSecret: string;
-    }>;
-    findActiveById(id: string): Promise<{
-        id: string;
-        name: string;
-        createdAt: Date;
-        updatedAt: Date;
-        orgId: string;
         clientId: string;
-        isActive: boolean;
+        clientSecret: string;
         scopes: string[];
         attributeMapping: unknown;
-        issuer: string;
-        authorizationEndpoint: string;
-        tokenEndpoint: string;
-        userinfoEndpoint: string | null;
-        jwksUri: string | null;
-        clientSecret: string;
+        isActive: boolean;
+        createdAt: Date;
+        updatedAt: Date;
     }>;
+    updateClientSecret(id: string, clientSecret: string): Promise<boolean>;
     create(input: {
         orgId: string;
         name: string;
@@ -94,38 +78,38 @@ export declare class DrizzleOidcConnectionRepository implements OidcConnectionRe
         attributeMapping?: Record<string, unknown>;
         isActive?: boolean;
     }): Promise<{
+        attributeMapping: unknown;
+        authorizationEndpoint: string;
+        clientId: string;
+        clientSecret: string;
+        createdAt: Date;
         id: string;
+        isActive: boolean;
+        issuer: string;
+        jwksUri: string | null;
         name: string;
-        createdAt: Date;
-        updatedAt: Date;
         orgId: string;
-        clientId: string;
-        isActive: boolean;
         scopes: string[];
-        attributeMapping: unknown;
-        issuer: string;
-        authorizationEndpoint: string;
         tokenEndpoint: string;
+        updatedAt: Date;
         userinfoEndpoint: string | null;
-        jwksUri: string | null;
-        clientSecret: string;
     }>;
     deleteByIdAndOrgId(id: string, orgId: string): Promise<{
+        attributeMapping: unknown;
+        authorizationEndpoint: string;
+        clientId: string;
+        clientSecret: string;
+        createdAt: Date;
         id: string;
+        isActive: boolean;
+        issuer: string;
+        jwksUri: string | null;
         name: string;
-        createdAt: Date;
-        updatedAt: Date;
         orgId: string;
-        clientId: string;
-        isActive: boolean;
         scopes: string[];
-        attributeMapping: unknown;
-        issuer: string;
-        authorizationEndpoint: string;
         tokenEndpoint: string;
+        updatedAt: Date;
         userinfoEndpoint: string | null;
-        jwksUri: string | null;
-        clientSecret: string;
     }>;
 }
 //# sourceMappingURL=oidcConnection.d.ts.map

package/dist/repositories/oidcConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidcConnection.d.ts","sourceRoot":"","sources":["../../src/repositories/oidcConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEvE,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC1D,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,EAAE;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,qBAAqB,EAAE,MAAM,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CACpF;AAED,qBAAa,+BAAgC,YAAW,wBAAwB;IACxE,WAAW,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;;;IAmBzB,QAAQ,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;;;;;;;IAKnB,cAAc,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;;;;;;;IAKzB,MAAM,CAAC,KAAK,EAAE;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,qBAAqB,EAAE,MAAM,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB;;;;;;;;;;;;;;;;;IAqBK,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;;;;;;CAOnD"}
+{"version":3,"file":"oidcConnection.d.ts","sourceRoot":"","sources":["../../src/repositories/oidcConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGvE,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC9D,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACvF,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,EAAE;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,qBAAqB,EAAE,MAAM,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CACpF;AAED,qBAAa,+BAAgC,YAAW,wBAAwB;IACxE,WAAW,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;;SAiB9B;IAEK,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;;;;;OAOrD;IAEK,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,oBAOxD;IAEK,MAAM,CAAC,KAAK,EAAE;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,qBAAqB,EAAE,MAAM,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB;;;;;;;;;;;;;;;;OAmBA;IAEK,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;;;;;OAMjD;CACF"}

package/dist/repositories/oidcConnection.js

@@ -1,6 +1,7 @@
 import { eq, and } from "drizzle-orm";
 import { db } from "../db/index.js";
 import { oidcConnections } from "../db/schema.js";
+import { encryptSecret } from "../services/secrets/index.js";
 export class DrizzleOidcConnectionRepository {
     async listByOrgId(orgId) {
         return db
@@ -20,13 +21,21 @@ export class DrizzleOidcConnectionRepository {
             .from(oidcConnections)
             .where(eq(oidcConnections.orgId, orgId));
     }
-    async findById(id) {
-        const [connection] = await db.select().from(oidcConnections).where(eq(oidcConnections.id, id)).limit(1);
+    async findActiveByIdAndOrgId(id, orgId) {
+        const [connection] = await db
+            .select()
+            .from(oidcConnections)
+            .where(and(eq(oidcConnections.id, id), eq(oidcConnections.orgId, orgId), eq(oidcConnections.isActive, true)))
+            .limit(1);
         return connection;
     }
-    async findActiveById(id) {
-        const [connection] = await db.select().from(oidcConnections).where(and(eq(oidcConnections.id, id), eq(oidcConnections.isActive, true))).limit(1);
-        return connection;
+    async updateClientSecret(id, clientSecret) {
+        const [updated] = await db
+            .update(oidcConnections)
+            .set({ clientSecret: await encryptSecret(clientSecret), updatedAt: new Date() })
+            .where(eq(oidcConnections.id, id))
+            .returning({ id: oidcConnections.id });
+        return Boolean(updated);
     }
     async create(input) {
         const [connection] = await db
@@ -40,7 +49,7 @@ export class DrizzleOidcConnectionRepository {
             userinfoEndpoint: input.userinfoEndpoint,
             jwksUri: input.jwksUri,
             clientId: input.clientId,
-            clientSecret: input.clientSecret,
+            clientSecret: await encryptSecret(input.clientSecret),
             scopes: input.scopes ?? ["openid", "profile", "email"],
             attributeMapping: input.attributeMapping ?? {},
             isActive: input.isActive ?? true,

package/dist/repositories/oidcConnection.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidcConnection.js","sourceRoot":"","sources":["../../src/repositories/oidcConnection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAuB,MAAM,iBAAiB,CAAC;AAqCvE,MAAM,OAAO,+BAA+B;IAC1C,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,EAAE;aACN,MAAM,CAAC;YACN,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,MAAM,EAAE,eAAe,CAAC,MAAM;YAC9B,qBAAqB,EAAE,eAAe,CAAC,qBAAqB;YAC5D,aAAa,EAAE,eAAe,CAAC,aAAa;YAC5C,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;YAClD,OAAO,EAAE,eAAe,CAAC,OAAO;YAChC,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,MAAM,EAAE,eAAe,CAAC,MAAM;YAC9B,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,SAAS,EAAE,eAAe,CAAC,SAAS;SACrC,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxG,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjJ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAaZ;QACC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YACtD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE;YAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;SACjC,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU,EAAE,KAAa;QAChD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACxE,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"oidcConnection.js","sourceRoot":"","sources":["../../src/repositories/oidcConnection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAuB,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAqC7D,MAAM,OAAO,+BAA+B;IAC1C,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,EAAE;aACN,MAAM,CAAC;YACN,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,MAAM,EAAE,eAAe,CAAC,MAAM;YAC9B,qBAAqB,EAAE,eAAe,CAAC,qBAAqB;YAC5D,aAAa,EAAE,eAAe,CAAC,aAAa;YAC5C,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;YAClD,OAAO,EAAE,eAAe,CAAC,OAAO;YAChC,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,MAAM,EAAE,eAAe,CAAC,MAAM;YAC9B,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,SAAS,EAAE,eAAe,CAAC,SAAS;SACrC,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,EAAU,EAAE,KAAa;QACpD,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;aAC5G,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU,EAAE,YAAoB;QACvD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/E,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACjC,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAaZ;QACC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC;YACrD,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YACtD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE;YAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;SACjC,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU,EAAE,KAAa;QAChD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACxE,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/repositories/organization.d.ts

@@ -1,9 +1,9 @@
 import { type Organization, type OrgMembership } from "../db/schema.js";
-import type { CreateOrganizationInput, OrganizationRepository } from "./types.js";
+import { type CreateOrganizationInput, type OrganizationRepository } from "./types.js";
 export type { OrganizationRepository } from "./types.js";
 export declare class DrizzleOrganizationRepository implements OrganizationRepository {
     private slugify;
-    create(input: CreateOrganizationInput): Promise<Organization>;
+    createWithOwner(input: CreateOrganizationInput, userId: string): Promise<Organization>;
     findById(id: string): Promise<Organization | undefined>;
     findBySlug(slug: string): Promise<Organization | undefined>;
     listAll(): Promise<Organization[]>;
@@ -16,29 +16,29 @@ export declare class DrizzleOrganizationRepository implements OrganizationReposi
     addMembership(input: {
         orgId: string;
         userId: string;
-        role: string;
+        role: "owner" | "admin" | "member";
     }): Promise<OrgMembership>;
     findMembership(orgId: string, userId: string): Promise<OrgMembership | undefined>;
-    updateMembershipRole(orgId: string, userId: string, role: string): Promise<OrgMembership | undefined>;
+    updateMembershipRole(orgId: string, userId: string, role: "owner" | "admin" | "member"): Promise<OrgMembership | undefined>;
     removeMembership(orgId: string, userId: string): Promise<boolean>;
     countOwners(orgId: string): Promise<number>;
     listMembers(orgId: string): Promise<{
         membership: {
             id: string;
+            orgId: string;
+            userId: string;
+            role: string;
             createdAt: Date;
             updatedAt: Date;
-            role: string;
-            userId: string;
-            orgId: string;
         };
         user: {
             id: string;
-            name: string | null;
             email: string;
             username: string;
+            name: string | null;
             avatarUrl: string | null;
+            platformRole: string;
         };
     }[]>;
-    private ensureUniqueSlug;
 }
 //# sourceMappingURL=organization.d.ts.map

package/dist/repositories/organization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../src/repositories/organization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwC,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC9G,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAElF,YAAY,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,qBAAa,6BAA8B,YAAW,sBAAsB;IAC1E,OAAO,CAAC,OAAO;IAST,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC;IAe7D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAKvD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAK3D,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAIlC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAanH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ5C,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IASrD,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAqB7F,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IASjF,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAS/B,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQjE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ3C,WAAW,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;;;;;;;YAiBjB,gBAAgB;CAc/B"}
+{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../src/repositories/organization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwC,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC9G,OAAO,EAA2B,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEhH,YAAY,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAIzD,qBAAa,6BAA8B,YAAW,sBAAsB;IAC1E,OAAO,CAAC,OAAO;IAST,eAAe,CAAC,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA8B3F;IAEK,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAG5D;IAEK,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAGhE;IAEK,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAEvC;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAWxH;IAEK,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjD;IAEK,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAO1D;IAEK,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CA6BxH;IAEK,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAOtF;IAEK,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GACjC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CA2BpC;IAEK,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBtE;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMhD;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;;;;;;;SAgB9B;CAEF"}

package/dist/repositories/organization.js

@@ -1,6 +1,8 @@
 import { eq, and, sql } from "drizzle-orm";
 import { db } from "../db/index.js";
 import { organizations, orgMemberships, users } from "../db/schema.js";
+import { LastOwnerInvariantError } from "./types.js";
+const ORGANIZATION_ROLES = new Set(["owner", "admin", "member"]);
 export class DrizzleOrganizationRepository {
     slugify(name) {
         return name
@@ -10,18 +12,36 @@ export class DrizzleOrganizationRepository {
             .replace(/^-+|-+$/g, "")
             .slice(0, 64);
     }
-    async create(input) {
+    async createWithOwner(input, userId) {
         const baseSlug = input.slug || this.slugify(input.name);
-        const slug = await this.ensureUniqueSlug(baseSlug);
-        const [org] = await db
-            .insert(organizations)
-            .values({
-            name: input.name,
-            slug,
-            plan: input.plan || "free",
-        })
-            .returning();
-        return org;
+        return db.transaction(async (tx) => {
+            const [owner] = await tx
+                .select({ id: users.id, isActive: users.isActive })
+                .from(users)
+                .where(eq(users.id, userId))
+                .limit(1);
+            if (!owner?.isActive)
+                throw new Error("Organization owner must be an active user");
+            let slug = baseSlug || "org";
+            let counter = 2;
+            while (true) {
+                const [existing] = await tx
+                    .select({ id: organizations.id })
+                    .from(organizations)
+                    .where(eq(organizations.slug, slug))
+                    .limit(1);
+                if (!existing)
+                    break;
+                slug = `${baseSlug}-${counter}`;
+                counter++;
+            }
+            const [org] = await tx
+                .insert(organizations)
+                .values({ name: input.name, slug, plan: input.plan || "free" })
+                .returning();
+            await tx.insert(orgMemberships).values({ orgId: org.id, userId, role: "owner" });
+            return org;
+        });
     }
     async findById(id) {
         const [org] = await db.select().from(organizations).where(eq(organizations.id, id)).limit(1);
@@ -62,6 +82,16 @@ export class DrizzleOrganizationRepository {
         return rows.map((r) => r.org);
     }
     async addMembership(input) {
+        // Lock the user row first. A concurrent organization removal decides
+        // whether the account should be deactivated by counting memberships, so
+        // adding one must not be able to slip in after that count is taken.
+        await db
+            .select({ id: users.id })
+            .from(users)
+            .where(eq(users.id, input.userId))
+            .for("update");
+        if (!ORGANIZATION_ROLES.has(input.role))
+            throw new Error("Invalid organization role");
         const [membership] = await db
             .insert(orgMemberships)
             .values({
@@ -89,19 +119,57 @@ export class DrizzleOrganizationRepository {
         return membership;
     }
     async updateMembershipRole(orgId, userId, role) {
-        const [updated] = await db
-            .update(orgMemberships)
-            .set({ role, updatedAt: sql `now()` })
-            .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
-            .returning();
-        return updated;
+        if (!ORGANIZATION_ROLES.has(role))
+            throw new Error("Invalid organization role");
+        return db.transaction(async (tx) => {
+            const [current] = await tx
+                .select()
+                .from(orgMemberships)
+                .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+                .limit(1);
+            if (!current)
+                return undefined;
+            if (current.role === "owner" && role !== "owner") {
+                const owners = await tx
+                    .select({ id: orgMemberships.id })
+                    .from(orgMemberships)
+                    .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.role, "owner")))
+                    .for("update");
+                if (owners.length <= 1)
+                    throw new LastOwnerInvariantError("Cannot demote the last organization owner");
+            }
+            const [updated] = await tx
+                .update(orgMemberships)
+                .set({ role, updatedAt: sql `now()` })
+                .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+                .returning();
+            return updated;
+        });
     }
     async removeMembership(orgId, userId) {
-        const deleted = await db
-            .delete(orgMemberships)
-            .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
-            .returning();
-        return deleted.length > 0;
+        return db.transaction(async (tx) => {
+            const [current] = await tx
+                .select()
+                .from(orgMemberships)
+                .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+                .limit(1);
+            if (!current)
+                return false;
+            if (current.role === "owner") {
+                const owners = await tx
+                    .select({ id: orgMemberships.id })
+                    .from(orgMemberships)
+                    .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.role, "owner")))
+                    .for("update");
+                if (owners.length <= 1)
+                    throw new LastOwnerInvariantError("Cannot remove the last organization owner");
+            }
+            const deleted = await tx
+                .delete(orgMemberships)
+                .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+                .returning();
+            return deleted.length > 0;
+        });
     }
     async countOwners(orgId) {
         const rows = await db
@@ -120,26 +188,12 @@ export class DrizzleOrganizationRepository {
                 username: users.username,
                 name: users.name,
                 avatarUrl: users.avatarUrl,
+                platformRole: users.role,
             },
         })
             .from(orgMemberships)
             .where(eq(orgMemberships.orgId, orgId))
             .innerJoin(users, eq(orgMemberships.userId, users.id));
     }
-    async ensureUniqueSlug(base) {
-        let slug = base || "org";
-        let counter = 2;
-        while (true) {
-            const existing = await db
-                .select({ id: organizations.id })
-                .from(organizations)
-                .where(eq(organizations.slug, slug))
-                .limit(1);
-            if (existing.length === 0)
-                return slug;
-            slug = `${base}-${counter}`;
-            counter++;
-        }
-    }
 }
 //# sourceMappingURL=organization.js.map

package/dist/repositories/organization.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../src/repositories/organization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,EAAyC,MAAM,iBAAiB,CAAC;AAK9G,MAAM,OAAO,6BAA6B;IAChC,OAAO,CAAC,IAAY;QAC1B,OAAO,IAAI;aACR,WAAW,EAAE;aACb,IAAI,EAAE;aACN,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;aAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;aACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA8B;QACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAEnD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,aAAa,CAAC;aACrB,MAAM,CAAC;YACN,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI;YACJ,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,MAAM;SAC3B,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjG,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAA4D;QACnF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,aAAa,CAAC;aACrB,GAAG,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aAC/B,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;aACxD,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1C,OAAO,QAAQ,EAAE,KAAK,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;aAC9B,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACxC,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAsD;QACxE,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC;aACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;aAC9E,SAAS,EAAE,CAAC;QAEf,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;aAC1F,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,MAAc;QAChD,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC9E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAa,EACb,MAAc,EACd,IAAY;QAEZ,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aACpC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC9E,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,MAAc;QAClD,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,cAAc,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC9E,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;aACxD,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,EAAE;aACN,MAAM,CAAC;YACN,UAAU,EAAE,cAAc;YAC1B,IAAI,EAAE;gBACJ,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,CAAC;aACD,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aACtC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,CAAC;QACzB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC;iBAChC,IAAI,CAAC,aAAa,CAAC;iBACnB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;iBACnC,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvC,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../src/repositories/organization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,EAAyC,MAAM,iBAAiB,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAA6D,MAAM,YAAY,CAAC;AAIhH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEjE,MAAM,OAAO,6BAA6B;IAChC,OAAO,CAAC,IAAY;QAC1B,OAAO,IAAI;aACR,WAAW,EAAE;aACb,IAAI,EAAE;aACN,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;aAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;aACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAA8B,EAAE,MAAc;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;iBAClD,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,KAAK,EAAE,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAEnF,IAAI,IAAI,GAAG,QAAQ,IAAI,KAAK,CAAC;YAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;qBACxB,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC;qBAChC,IAAI,CAAC,aAAa,CAAC;qBACnB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;qBACnC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACZ,IAAI,CAAC,QAAQ;oBAAE,MAAM;gBACrB,IAAI,GAAG,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC;gBAChC,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,aAAa,CAAC;iBACrB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;iBAC9D,SAAS,EAAE,CAAC;YACf,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACjF,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjG,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAA4D;QACnF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,aAAa,CAAC;aACrB,GAAG,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aAC/B,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;aACxD,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1C,OAAO,QAAQ,EAAE,KAAK,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;aAC9B,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACxC,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA4E;QAC9F,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,EAAE;aACL,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;aACxB,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;aACjC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEjB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtF,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC;aACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;aAC9E,SAAS,EAAE,CAAC;QAEf,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;aAC1F,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,MAAc;QAChD,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC9E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAa,EACb,MAAc,EACd,IAAkC;QAElC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAEhF,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,EAAE;iBACR,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBAC9E,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAE/B,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACjD,MAAM,MAAM,GAAG,MAAM,EAAE;qBACpB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;qBACjC,IAAI,CAAC,cAAc,CAAC;qBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;qBAC7E,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjB,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;oBAAE,MAAM,IAAI,uBAAuB,CAAC,2CAA2C,CAAC,CAAC;YACzG,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,cAAc,CAAC;iBACtB,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;iBACpC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBAC9E,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,EAAE;iBACR,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBAC9E,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YAE3B,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,EAAE;qBACpB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;qBACjC,IAAI,CAAC,cAAc,CAAC;qBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;qBAC7E,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjB,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;oBAAE,MAAM,IAAI,uBAAuB,CAAC,2CAA2C,CAAC,CAAC;YACzG,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,cAAc,CAAC;iBACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBAC9E,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;aACxD,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,EAAE;aACN,MAAM,CAAC;YACN,UAAU,EAAE,cAAc;YAC1B,IAAI,EAAE;gBACJ,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,YAAY,EAAE,KAAK,CAAC,IAAI;aACzB;SACF,CAAC;aACD,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aACtC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;CAEF"}

package/dist/repositories/permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../../src/repositories/permission.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAChG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAqDvD,qBAAa,2BAA4B,YAAW,oBAAoB;IAChE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAa7B,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IAmB5C,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAI7B,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAQtC,MAAM,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAS9F,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAKnD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAShD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAKnD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjE,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAIzG"}
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../../src/repositories/permission.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAChG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAmEvD,qBAAa,2BAA4B,YAAW,oBAAoB;IAChE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAWlC;IAEK,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC,CAkBjD;IAEK,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAElC;IAEK,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAW3C;IAEK,MAAM,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAOnG;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAGxD;IAEK,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAOrD;IAEK,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAGxD;IAEK,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMpE;IAEK,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtE;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIpF;IAEK,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvG;CACF"}

package/dist/repositories/permission.js

@@ -1,6 +1,11 @@
-import { eq, and } from "drizzle-orm";
+import { eq, and, notInArray } from "drizzle-orm";
 import { db } from "../db/index.js";
 import { permissions, rolePermissions, orgMemberships } from "../db/schema.js";
+const ORGANIZATION_ROLES = new Set(["owner", "admin", "member"]);
+function assertOrganizationRole(role) {
+    if (!ORGANIZATION_ROLES.has(role))
+        throw new Error("Invalid organization role");
+}
 const DEFAULT_PERMISSIONS = [
     { resource: "organization", action: "read" },
     { resource: "organization", action: "update" },
@@ -19,6 +24,10 @@ const DEFAULT_PERMISSIONS = [
     { resource: "api_key", action: "create" },
     { resource: "api_key", action: "revoke" },
     { resource: "audit_log", action: "read" },
+    { resource: "sso_connection", action: "read" },
+    { resource: "sso_connection", action: "manage" },
+    { resource: "billing", action: "read" },
+    { resource: "billing", action: "update" },
 ];
 const DEFAULT_ROLE_PERMISSIONS = {
     owner: DEFAULT_PERMISSIONS.map((p) => `${p.resource}:${p.action}`),
@@ -37,14 +46,18 @@ const DEFAULT_ROLE_PERMISSIONS = {
         "api_key:create",
         "api_key:revoke",
         "audit_log:read",
+        "sso_connection:read",
+        "sso_connection:manage",
+        "billing:read",
+        "billing:update",
     ],
     member: [
         "organization:read",
         "application:read",
         "service_account:read",
         "api_key:read",
+        "sso_connection:read",
     ],
-    viewer: ["organization:read", "application:read", "audit_log:read"],
 };
 function permissionKey(resource, action) {
     return `${resource}:${action}`;
@@ -59,6 +72,7 @@ export class DrizzlePermissionRepository {
         }
     }
     async ensureRolePermissionsSeeded() {
+        await db.delete(rolePermissions).where(notInArray(rolePermissions.role, ["owner", "admin", "member"]));
         await this.ensureSeeded();
         const allPermissions = await db.select().from(permissions);
         const permissionByKey = new Map(allPermissions.map((p) => [permissionKey(p.resource, p.action), p.id]));
@@ -79,10 +93,16 @@ export class DrizzlePermissionRepository {
     }
     async listDistinctRoles() {
         const rows = await db.selectDistinct({ role: rolePermissions.role }).from(rolePermissions);
-        const roles = new Set(["owner", "admin", "member", ...rows.map((r) => r.role)]);
+        const roles = new Set(["owner", "admin", "member"]);
+        for (const row of rows) {
+            if (ORGANIZATION_ROLES.has(row.role))
+                roles.add(row.role);
+        }
         const memberships = await db.selectDistinct({ role: orgMemberships.role }).from(orgMemberships);
-        for (const m of memberships)
-            roles.add(m.role);
+        for (const membership of memberships) {
+            if (ORGANIZATION_ROLES.has(membership.role))
+                roles.add(membership.role);
+        }
         return [...roles].sort();
     }
     async create(input) {
@@ -110,12 +130,14 @@ export class DrizzlePermissionRepository {
         return new Set(perms.map((p) => permissionKey(p.resource, p.action)));
     }
     async assignToRole(role, permissionId) {
+        assertOrganizationRole(role);
         await db
             .insert(rolePermissions)
             .values({ role, permissionId })
             .onConflictDoNothing({ target: [rolePermissions.role, rolePermissions.permissionId] });
     }
     async removeFromRole(role, permissionId) {
+        assertOrganizationRole(role);
         await db
             .delete(rolePermissions)
             .where(and(eq(rolePermissions.role, role), eq(rolePermissions.permissionId, permissionId)));