@inkeep/agents-core 0.0.0-dev-20251219041142 → 0.0.0-dev-20251219051850
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth/auth.d.ts +18 -18
- package/dist/auth/auth.d.ts.map +1 -1
- package/dist/auth/auth.js +2 -1
- package/dist/auth/auth.js.map +1 -1
- package/dist/auth/permissions.d.ts +9 -9
- package/dist/auth/permissions.d.ts.map +1 -1
- package/dist/client-exports.d.ts +2 -2
- package/dist/client-exports.d.ts.map +1 -1
- package/dist/client.d.ts +242 -242
- package/dist/client.d.ts.map +1 -1
- package/dist/env.js +1 -0
- package/dist/env.js.map +1 -1
- package/dist/models.d.ts.map +1 -1
- package/package.json +1 -1
package/dist/auth/auth.d.ts
CHANGED
|
@@ -829,25 +829,25 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
|
|
|
829
829
|
ac: better_auth_plugins0.AccessControl;
|
|
830
830
|
roles: {
|
|
831
831
|
member: {
|
|
832
|
-
authorize<K_1 extends "function" | "organization" | "
|
|
833
|
-
actions: better_auth_plugins0.Subset<"function" | "organization" | "
|
|
832
|
+
authorize<K_1 extends "function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key] | {
|
|
833
|
+
actions: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key];
|
|
834
834
|
connector: "OR" | "AND";
|
|
835
835
|
} | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
|
|
836
|
-
statements: better_auth_plugins0.Subset<"function" | "organization" | "
|
|
836
|
+
statements: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>;
|
|
837
837
|
};
|
|
838
838
|
admin: {
|
|
839
|
-
authorize<K_1 extends "function" | "organization" | "
|
|
840
|
-
actions: better_auth_plugins0.Subset<"function" | "organization" | "
|
|
839
|
+
authorize<K_1 extends "function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key] | {
|
|
840
|
+
actions: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key];
|
|
841
841
|
connector: "OR" | "AND";
|
|
842
842
|
} | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
|
|
843
|
-
statements: better_auth_plugins0.Subset<"function" | "organization" | "
|
|
843
|
+
statements: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>;
|
|
844
844
|
};
|
|
845
845
|
owner: {
|
|
846
|
-
authorize<K_1 extends "function" | "organization" | "
|
|
847
|
-
actions: better_auth_plugins0.Subset<"function" | "organization" | "
|
|
846
|
+
authorize<K_1 extends "function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key] | {
|
|
847
|
+
actions: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key];
|
|
848
848
|
connector: "OR" | "AND";
|
|
849
849
|
} | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
|
|
850
|
-
statements: better_auth_plugins0.Subset<"function" | "organization" | "
|
|
850
|
+
statements: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>;
|
|
851
851
|
};
|
|
852
852
|
};
|
|
853
853
|
membershipLimit: number;
|
|
@@ -1108,25 +1108,25 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
|
|
|
1108
1108
|
ac: better_auth_plugins0.AccessControl;
|
|
1109
1109
|
roles: {
|
|
1110
1110
|
member: {
|
|
1111
|
-
authorize<K_1 extends "function" | "organization" | "
|
|
1112
|
-
actions: better_auth_plugins0.Subset<"function" | "organization" | "
|
|
1111
|
+
authorize<K_1 extends "function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key] | {
|
|
1112
|
+
actions: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key];
|
|
1113
1113
|
connector: "OR" | "AND";
|
|
1114
1114
|
} | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
|
|
1115
|
-
statements: better_auth_plugins0.Subset<"function" | "organization" | "
|
|
1115
|
+
statements: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>;
|
|
1116
1116
|
};
|
|
1117
1117
|
admin: {
|
|
1118
|
-
authorize<K_1 extends "function" | "organization" | "
|
|
1119
|
-
actions: better_auth_plugins0.Subset<"function" | "organization" | "
|
|
1118
|
+
authorize<K_1 extends "function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key] | {
|
|
1119
|
+
actions: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key];
|
|
1120
1120
|
connector: "OR" | "AND";
|
|
1121
1121
|
} | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
|
|
1122
|
-
statements: better_auth_plugins0.Subset<"function" | "organization" | "
|
|
1122
|
+
statements: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>;
|
|
1123
1123
|
};
|
|
1124
1124
|
owner: {
|
|
1125
|
-
authorize<K_1 extends "function" | "organization" | "
|
|
1126
|
-
actions: better_auth_plugins0.Subset<"function" | "organization" | "
|
|
1125
|
+
authorize<K_1 extends "function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key] | {
|
|
1126
|
+
actions: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key];
|
|
1127
1127
|
connector: "OR" | "AND";
|
|
1128
1128
|
} | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
|
|
1129
|
-
statements: better_auth_plugins0.Subset<"function" | "organization" | "
|
|
1129
|
+
statements: better_auth_plugins0.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>;
|
|
1130
1130
|
};
|
|
1131
1131
|
};
|
|
1132
1132
|
membershipLimit: number;
|
package/dist/auth/auth.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.d.ts","names":[],"sources":["../../src/auth/auth.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;UAYiB,kBAAA;;;;;;;;;;EAAA,OAAA,CAAA,EAAA;IAoBA,EAAA,CAAA,EAAA,MAAA;IAoBA,KAAA,CAAA,EAAA,MAAA;IASA,aAAA,CAAA,EAAgB,MAAA;IAGrB,IAAA,CAAA,EAAA,MAAA;IACK,KAAA,CAAA,EAAA,MAAA;IAEJ,WAAA,CAAA,EAvCK,MAuCL,CAAA,MAAA,EAAA,MAAA,CAAA;EAEA,CAAA;;AAGI,UAxCA,kBAAA,CAwCc;EACd,UAAA,EAAA,MAAA;EAEJ,IAAA,EAAA,MAAA;EAEA,WAAA,EAAA,MAAA;EAAyB,QAAA,CAAA,EAAA,MAAA;EA0FtB,oBAAU,CAAA,EAAA,OAAA;EAAS,kBAAA,CAAA,EAAA,MAAA;EAAgB,eAAA,CAAA,EAAA,MAAA;;;
|
|
1
|
+
{"version":3,"file":"auth.d.ts","names":[],"sources":["../../src/auth/auth.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;UAYiB,kBAAA;;;;;;;;;;EAAA,OAAA,CAAA,EAAA;IAoBA,EAAA,CAAA,EAAA,MAAA;IAoBA,KAAA,CAAA,EAAA,MAAA;IASA,aAAA,CAAA,EAAgB,MAAA;IAGrB,IAAA,CAAA,EAAA,MAAA;IACK,KAAA,CAAA,EAAA,MAAA;IAEJ,WAAA,CAAA,EAvCK,MAuCL,CAAA,MAAA,EAAA,MAAA,CAAA;EAEA,CAAA;;AAGI,UAxCA,kBAAA,CAwCc;EACd,UAAA,EAAA,MAAA;EAEJ,IAAA,EAAA,MAAA;EAEA,WAAA,EAAA,MAAA;EAAyB,QAAA,CAAA,EAAA,MAAA;EA0FtB,oBAAU,CAAA,EAAA,OAAA;EAAS,kBAAA,CAAA,EAAA,MAAA;EAAgB,eAAA,CAAA,EAAA,MAAA;;;IAkH6vhB,EAAA,CAAA,EAAA,MAAA;IAAA,KAAA,CAAA,EAAA,MAAA;;;;;kBAzO9xhB;;;UAID,iBAAA,CAqO6zvJ;EAAA,UAAA,EAAA,MAAA;;;;eAhO/zvJ;eACA;;UAGE,gBAAA;;;YAGL;iBACK;;aAEJ;;aAEA;;UAGI,cAAA;iBACA;;aAEJ;;aAEA;;iBA0FG,UAAA,SAAmB,gCAAgB;;;sBAAA,YAAA,CAAA;;;;;;;;;;;;;;;;;;;;0DAkH6vhB;6BAAA,YAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAA4jrI;;;6BAAA,YAAA,CAAA;;;;;gCAAk+C,YAAA;;;;;;;;;yBAAA,YAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAlH3xvJ,WAAA,EAAA,MAAA;wBAAA,CAAA;wBAiHN,WAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAAhC,MAAsB,kBAAkB"}
|
package/dist/auth/auth.js
CHANGED
|
@@ -100,7 +100,8 @@ function createAuth(config) {
|
|
|
100
100
|
"http://localhost:3000",
|
|
101
101
|
"http://localhost:3002",
|
|
102
102
|
env.INKEEP_AGENTS_MANAGE_UI_URL,
|
|
103
|
-
env.INKEEP_AGENTS_MANAGE_API_URL
|
|
103
|
+
env.INKEEP_AGENTS_MANAGE_API_URL,
|
|
104
|
+
env.TRUSTED_ORIGIN
|
|
104
105
|
].filter((origin) => typeof origin === "string" && origin.length > 0),
|
|
105
106
|
plugins: [
|
|
106
107
|
bearer(),
|
package/dist/auth/auth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","names":["domainParts: string[]","authSchema.ssoProvider","auth"],"sources":["../../src/auth/auth.ts"],"sourcesContent":["import { sso } from '@better-auth/sso';\nimport { type BetterAuthAdvancedOptions, betterAuth } from 'better-auth';\nimport { drizzleAdapter } from 'better-auth/adapters/drizzle';\nimport { bearer, deviceAuthorization, oAuthProxy, organization } from 'better-auth/plugins';\nimport type { GoogleOptions } from 'better-auth/social-providers';\nimport { eq } from 'drizzle-orm';\nimport type { DatabaseClient } from '../db/client';\nimport { env } from '../env';\nimport { generateId } from '../utils';\nimport * as authSchema from './auth-schema';\nimport { ac, adminRole, memberRole, ownerRole } from './permissions';\n\nexport interface OIDCProviderConfig {\n clientId: string;\n clientSecret: string;\n authorizationEndpoint?: string;\n tokenEndpoint?: string;\n userinfoEndpoint?: string;\n jwksEndpoint?: string;\n discoveryEndpoint?: string;\n scopes?: string[];\n pkce?: boolean;\n mapping?: {\n id?: string;\n email?: string;\n emailVerified?: string;\n name?: string;\n image?: string;\n extraFields?: Record<string, string>;\n };\n}\n\nexport interface SAMLProviderConfig {\n entryPoint: string;\n cert: string;\n callbackUrl: string;\n audience?: string;\n wantAssertionsSigned?: boolean;\n signatureAlgorithm?: string;\n digestAlgorithm?: string;\n identifierFormat?: string;\n mapping?: {\n id?: string;\n email?: string;\n name?: string;\n firstName?: string;\n lastName?: string;\n emailVerified?: string;\n extraFields?: Record<string, string>;\n };\n}\n\nexport interface SSOProviderConfig {\n providerId: string;\n issuer: string;\n domain: string;\n organizationId?: string;\n oidcConfig?: OIDCProviderConfig;\n samlConfig?: SAMLProviderConfig;\n}\n\nexport interface BetterAuthConfig {\n baseURL: string;\n secret: string;\n dbClient: DatabaseClient;\n ssoProviders?: SSOProviderConfig[];\n socialProviders?: {\n google?: GoogleOptions;\n };\n advanced?: BetterAuthAdvancedOptions;\n}\n\nexport interface UserAuthConfig {\n ssoProviders?: SSOProviderConfig[];\n socialProviders?: {\n google?: GoogleOptions;\n };\n advanced?: BetterAuthAdvancedOptions;\n}\n\n/**\n * Extracts the root domain from a URL for cross-subdomain cookie sharing.\n * For example:\n * - https://manage-api.pilot.inkeep.com -> .pilot.inkeep.com\n * - https://pilot.inkeep.com -> .pilot.inkeep.com\n * - http://localhost:3002 -> undefined (no domain for localhost)\n *\n * The logic extracts the parent domain that can be shared across subdomains.\n * For domains with 3+ parts, it takes everything except the first part.\n * For domains with exactly 2 parts, it takes both parts.\n */\nfunction extractCookieDomain(baseURL: string): string | undefined {\n try {\n const url = new URL(baseURL);\n const hostname = url.hostname;\n\n // Don't set domain for localhost or IP addresses\n if (hostname === 'localhost' || hostname.match(/^\\d+\\.\\d+\\.\\d+\\.\\d+$/)) {\n return undefined;\n }\n\n // Split hostname into parts\n const parts = hostname.split('.');\n\n // We need at least 2 parts to form a domain (e.g., inkeep.com)\n if (parts.length < 2) {\n return undefined;\n }\n\n // Extract the parent domain that can be shared across subdomains\n // Examples:\n // - pilot.inkeep.com (3 parts) -> take all 3 parts -> .pilot.inkeep.com\n // - manage-api.pilot.inkeep.com (4 parts) -> take last 3 parts -> .pilot.inkeep.com\n // - inkeep.com (2 parts) -> take both parts -> .inkeep.com\n\n let domainParts: string[];\n if (parts.length === 3) {\n // For 3-part domains like pilot.inkeep.com, take all parts\n domainParts = parts;\n } else if (parts.length > 3) {\n // For 4+ part domains like manage-api.pilot.inkeep.com, take everything except first\n domainParts = parts.slice(1);\n } else {\n // For 2-part domains like inkeep.com, take both parts\n domainParts = parts;\n }\n\n return `.${domainParts.join('.')}`;\n } catch {\n return undefined;\n }\n}\n\nasync function registerSSOProvider(\n dbClient: DatabaseClient,\n provider: SSOProviderConfig\n): Promise<void> {\n try {\n const existing = await dbClient\n .select()\n .from(authSchema.ssoProvider)\n .where(eq(authSchema.ssoProvider.providerId, provider.providerId))\n .limit(1);\n\n if (existing.length > 0) {\n return;\n }\n\n if (!provider.domain) {\n throw new Error(`SSO provider '${provider.providerId}' must have a domain`);\n }\n\n await dbClient.insert(authSchema.ssoProvider).values({\n id: generateId(),\n providerId: provider.providerId,\n issuer: provider.issuer,\n domain: provider.domain,\n oidcConfig: provider.oidcConfig ? JSON.stringify(provider.oidcConfig) : null,\n samlConfig: provider.samlConfig ? JSON.stringify(provider.samlConfig) : null,\n userId: null,\n organizationId: provider.organizationId || null,\n });\n } catch (error) {\n console.error(`❌ Failed to register SSO provider '${provider.providerId}':`, error);\n }\n}\n\nexport function createAuth(config: BetterAuthConfig) {\n // Extract cookie domain from baseURL for cross-subdomain cookie sharing\n const cookieDomain = extractCookieDomain(config.baseURL);\n\n const auth = betterAuth({\n baseURL: config.baseURL,\n secret: config.secret,\n database: drizzleAdapter(config.dbClient, {\n provider: 'pg',\n }),\n emailAndPassword: {\n enabled: true,\n minPasswordLength: 8,\n maxPasswordLength: 128,\n requireEmailVerification: false,\n autoSignIn: true,\n },\n socialProviders: config.socialProviders?.google && {\n google: {\n ...config.socialProviders.google,\n // For local/preview env, redirect to production URL registered in Google Console\n ...(env.OAUTH_PROXY_PRODUCTION_URL && {\n redirectURI: `${env.OAUTH_PROXY_PRODUCTION_URL}/api/auth/callback/google`,\n }),\n },\n },\n session: {\n expiresIn: 60 * 60 * 24 * 7,\n updateAge: 60 * 60 * 24,\n cookieCache: {\n enabled: true,\n maxAge: 5 * 60,\n strategy: 'compact',\n },\n },\n advanced: {\n crossSubDomainCookies: {\n enabled: true,\n ...(cookieDomain && { domain: cookieDomain }),\n },\n defaultCookieAttributes: {\n sameSite: 'none',\n secure: true,\n httpOnly: true,\n partitioned: true,\n ...(cookieDomain && { domain: cookieDomain }),\n },\n ...config.advanced,\n },\n trustedOrigins: [\n 'http://localhost:3000',\n 'http://localhost:3002',\n env.INKEEP_AGENTS_MANAGE_UI_URL,\n env.INKEEP_AGENTS_MANAGE_API_URL,\n ].filter((origin): origin is string => typeof origin === 'string' && origin.length > 0),\n plugins: [\n bearer(),\n sso(),\n oAuthProxy({\n productionURL: env.OAUTH_PROXY_PRODUCTION_URL || config.baseURL,\n }),\n organization({\n allowUserToCreateOrganization: true,\n ac,\n roles: {\n member: memberRole,\n admin: adminRole,\n owner: ownerRole,\n },\n membershipLimit: 300,\n invitationLimit: 300,\n invitationExpiresIn: 7 * 24 * 60 * 60, // 7 days (in seconds)\n async sendInvitationEmail(data) {\n console.log('📧 Invitation created:', {\n email: data.email,\n invitedBy: data.inviter.user.name || data.inviter.user.email,\n organization: data.organization.name,\n invitationId: data.id,\n });\n\n // Note: The invitation link is displayed in the UI with a copy button.\n // If you want to send actual emails, configure an email provider:\n // - Resend: await resend.emails.send({ ... })\n // - SendGrid: await sgMail.send({ ... })\n // - AWS SES: await ses.sendEmail({ ... })\n // - Postmark: await postmark.sendEmail({ ... })\n },\n }),\n deviceAuthorization({\n verificationUri: '/device',\n expiresIn: '60m', // 30 minutes\n interval: '5s', // 5 second polling interval\n userCodeLength: 8, // e.g., \"ABCD-EFGH\"\n }),\n ],\n });\n\n if (config.ssoProviders?.length) {\n const providers = config.ssoProviders;\n setTimeout(async () => {\n for (const provider of providers) {\n await registerSSOProvider(config.dbClient, provider);\n }\n }, 1000);\n }\n\n return auth;\n}\n\n// Type placeholder for type inference in consuming code (e.g., app.ts AppVariables)\n// Actual auth instances should be created using createAuth() with a real database client\n// This is cast as any to avoid instantiation while preserving type information\nexport const auth = null as any as ReturnType<typeof createAuth>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA2FA,SAAS,oBAAoB,SAAqC;AAChE,KAAI;EAEF,MAAM,WADM,IAAI,IAAI,QAAQ,CACP;AAGrB,MAAI,aAAa,eAAe,SAAS,MAAM,uBAAuB,CACpE;EAIF,MAAM,QAAQ,SAAS,MAAM,IAAI;AAGjC,MAAI,MAAM,SAAS,EACjB;EASF,IAAIA;AACJ,MAAI,MAAM,WAAW,EAEnB,eAAc;WACL,MAAM,SAAS,EAExB,eAAc,MAAM,MAAM,EAAE;MAG5B,eAAc;AAGhB,SAAO,IAAI,YAAY,KAAK,IAAI;SAC1B;AACN;;;AAIJ,eAAe,oBACb,UACA,UACe;AACf,KAAI;AAOF,OANiB,MAAM,SACpB,QAAQ,CACR,KAAKC,YAAuB,CAC5B,MAAM,eAA0B,YAAY,SAAS,WAAW,CAAC,CACjE,MAAM,EAAE,EAEE,SAAS,EACpB;AAGF,MAAI,CAAC,SAAS,OACZ,OAAM,IAAI,MAAM,iBAAiB,SAAS,WAAW,sBAAsB;AAG7E,QAAM,SAAS,OAAOA,YAAuB,CAAC,OAAO;GACnD,IAAI,YAAY;GAChB,YAAY,SAAS;GACrB,QAAQ,SAAS;GACjB,QAAQ,SAAS;GACjB,YAAY,SAAS,aAAa,KAAK,UAAU,SAAS,WAAW,GAAG;GACxE,YAAY,SAAS,aAAa,KAAK,UAAU,SAAS,WAAW,GAAG;GACxE,QAAQ;GACR,gBAAgB,SAAS,kBAAkB;GAC5C,CAAC;UACK,OAAO;AACd,UAAQ,MAAM,sCAAsC,SAAS,WAAW,KAAK,MAAM;;;AAIvF,SAAgB,WAAW,QAA0B;CAEnD,MAAM,eAAe,oBAAoB,OAAO,QAAQ;CAExD,MAAMC,SAAO,WAAW;EACtB,SAAS,OAAO;EAChB,QAAQ,OAAO;EACf,UAAU,eAAe,OAAO,UAAU,EACxC,UAAU,MACX,CAAC;EACF,kBAAkB;GAChB,SAAS;GACT,mBAAmB;GACnB,mBAAmB;GACnB,0BAA0B;GAC1B,YAAY;GACb;EACD,iBAAiB,OAAO,iBAAiB,UAAU,EACjD,QAAQ;GACN,GAAG,OAAO,gBAAgB;GAE1B,GAAI,IAAI,8BAA8B,EACpC,aAAa,GAAG,IAAI,2BAA2B,4BAChD;GACF,EACF;EACD,SAAS;GACP,WAAW,OAAU,KAAK;GAC1B,WAAW,OAAU;GACrB,aAAa;IACX,SAAS;IACT,QAAQ;IACR,UAAU;IACX;GACF;EACD,UAAU;GACR,uBAAuB;IACrB,SAAS;IACT,GAAI,gBAAgB,EAAE,QAAQ,cAAc;IAC7C;GACD,yBAAyB;IACvB,UAAU;IACV,QAAQ;IACR,UAAU;IACV,aAAa;IACb,GAAI,gBAAgB,EAAE,QAAQ,cAAc;IAC7C;GACD,GAAG,OAAO;GACX;EACD,gBAAgB;GACd;GACA;GACA,IAAI;GACJ,IAAI;GACL,CAAC,QAAQ,WAA6B,OAAO,WAAW,YAAY,OAAO,SAAS,EAAE;EACvF,SAAS;GACP,QAAQ;GACR,KAAK;GACL,WAAW,EACT,eAAe,IAAI,8BAA8B,OAAO,SACzD,CAAC;GACF,aAAa;IACX,+BAA+B;IAC/B;IACA,OAAO;KACL,QAAQ;KACR,OAAO;KACP,OAAO;KACR;IACD,iBAAiB;IACjB,iBAAiB;IACjB,qBAAqB,QAAc;IACnC,MAAM,oBAAoB,MAAM;AAC9B,aAAQ,IAAI,0BAA0B;MACpC,OAAO,KAAK;MACZ,WAAW,KAAK,QAAQ,KAAK,QAAQ,KAAK,QAAQ,KAAK;MACvD,cAAc,KAAK,aAAa;MAChC,cAAc,KAAK;MACpB,CAAC;;IASL,CAAC;GACF,oBAAoB;IAClB,iBAAiB;IACjB,WAAW;IACX,UAAU;IACV,gBAAgB;IACjB,CAAC;GACH;EACF,CAAC;AAEF,KAAI,OAAO,cAAc,QAAQ;EAC/B,MAAM,YAAY,OAAO;AACzB,aAAW,YAAY;AACrB,QAAK,MAAM,YAAY,UACrB,OAAM,oBAAoB,OAAO,UAAU,SAAS;KAErD,IAAK;;AAGV,QAAOA;;AAMT,MAAa,OAAO"}
|
|
1
|
+
{"version":3,"file":"auth.js","names":["domainParts: string[]","authSchema.ssoProvider","auth"],"sources":["../../src/auth/auth.ts"],"sourcesContent":["import { sso } from '@better-auth/sso';\nimport { type BetterAuthAdvancedOptions, betterAuth } from 'better-auth';\nimport { drizzleAdapter } from 'better-auth/adapters/drizzle';\nimport { bearer, deviceAuthorization, oAuthProxy, organization } from 'better-auth/plugins';\nimport type { GoogleOptions } from 'better-auth/social-providers';\nimport { eq } from 'drizzle-orm';\nimport type { DatabaseClient } from '../db/client';\nimport { env } from '../env';\nimport { generateId } from '../utils';\nimport * as authSchema from './auth-schema';\nimport { ac, adminRole, memberRole, ownerRole } from './permissions';\n\nexport interface OIDCProviderConfig {\n clientId: string;\n clientSecret: string;\n authorizationEndpoint?: string;\n tokenEndpoint?: string;\n userinfoEndpoint?: string;\n jwksEndpoint?: string;\n discoveryEndpoint?: string;\n scopes?: string[];\n pkce?: boolean;\n mapping?: {\n id?: string;\n email?: string;\n emailVerified?: string;\n name?: string;\n image?: string;\n extraFields?: Record<string, string>;\n };\n}\n\nexport interface SAMLProviderConfig {\n entryPoint: string;\n cert: string;\n callbackUrl: string;\n audience?: string;\n wantAssertionsSigned?: boolean;\n signatureAlgorithm?: string;\n digestAlgorithm?: string;\n identifierFormat?: string;\n mapping?: {\n id?: string;\n email?: string;\n name?: string;\n firstName?: string;\n lastName?: string;\n emailVerified?: string;\n extraFields?: Record<string, string>;\n };\n}\n\nexport interface SSOProviderConfig {\n providerId: string;\n issuer: string;\n domain: string;\n organizationId?: string;\n oidcConfig?: OIDCProviderConfig;\n samlConfig?: SAMLProviderConfig;\n}\n\nexport interface BetterAuthConfig {\n baseURL: string;\n secret: string;\n dbClient: DatabaseClient;\n ssoProviders?: SSOProviderConfig[];\n socialProviders?: {\n google?: GoogleOptions;\n };\n advanced?: BetterAuthAdvancedOptions;\n}\n\nexport interface UserAuthConfig {\n ssoProviders?: SSOProviderConfig[];\n socialProviders?: {\n google?: GoogleOptions;\n };\n advanced?: BetterAuthAdvancedOptions;\n}\n\n/**\n * Extracts the root domain from a URL for cross-subdomain cookie sharing.\n * For example:\n * - https://manage-api.pilot.inkeep.com -> .pilot.inkeep.com\n * - https://pilot.inkeep.com -> .pilot.inkeep.com\n * - http://localhost:3002 -> undefined (no domain for localhost)\n *\n * The logic extracts the parent domain that can be shared across subdomains.\n * For domains with 3+ parts, it takes everything except the first part.\n * For domains with exactly 2 parts, it takes both parts.\n */\nfunction extractCookieDomain(baseURL: string): string | undefined {\n try {\n const url = new URL(baseURL);\n const hostname = url.hostname;\n\n // Don't set domain for localhost or IP addresses\n if (hostname === 'localhost' || hostname.match(/^\\d+\\.\\d+\\.\\d+\\.\\d+$/)) {\n return undefined;\n }\n\n // Split hostname into parts\n const parts = hostname.split('.');\n\n // We need at least 2 parts to form a domain (e.g., inkeep.com)\n if (parts.length < 2) {\n return undefined;\n }\n\n // Extract the parent domain that can be shared across subdomains\n // Examples:\n // - pilot.inkeep.com (3 parts) -> take all 3 parts -> .pilot.inkeep.com\n // - manage-api.pilot.inkeep.com (4 parts) -> take last 3 parts -> .pilot.inkeep.com\n // - inkeep.com (2 parts) -> take both parts -> .inkeep.com\n\n let domainParts: string[];\n if (parts.length === 3) {\n // For 3-part domains like pilot.inkeep.com, take all parts\n domainParts = parts;\n } else if (parts.length > 3) {\n // For 4+ part domains like manage-api.pilot.inkeep.com, take everything except first\n domainParts = parts.slice(1);\n } else {\n // For 2-part domains like inkeep.com, take both parts\n domainParts = parts;\n }\n\n return `.${domainParts.join('.')}`;\n } catch {\n return undefined;\n }\n}\n\nasync function registerSSOProvider(\n dbClient: DatabaseClient,\n provider: SSOProviderConfig\n): Promise<void> {\n try {\n const existing = await dbClient\n .select()\n .from(authSchema.ssoProvider)\n .where(eq(authSchema.ssoProvider.providerId, provider.providerId))\n .limit(1);\n\n if (existing.length > 0) {\n return;\n }\n\n if (!provider.domain) {\n throw new Error(`SSO provider '${provider.providerId}' must have a domain`);\n }\n\n await dbClient.insert(authSchema.ssoProvider).values({\n id: generateId(),\n providerId: provider.providerId,\n issuer: provider.issuer,\n domain: provider.domain,\n oidcConfig: provider.oidcConfig ? JSON.stringify(provider.oidcConfig) : null,\n samlConfig: provider.samlConfig ? JSON.stringify(provider.samlConfig) : null,\n userId: null,\n organizationId: provider.organizationId || null,\n });\n } catch (error) {\n console.error(`❌ Failed to register SSO provider '${provider.providerId}':`, error);\n }\n}\n\nexport function createAuth(config: BetterAuthConfig) {\n // Extract cookie domain from baseURL for cross-subdomain cookie sharing\n const cookieDomain = extractCookieDomain(config.baseURL);\n\n const auth = betterAuth({\n baseURL: config.baseURL,\n secret: config.secret,\n database: drizzleAdapter(config.dbClient, {\n provider: 'pg',\n }),\n emailAndPassword: {\n enabled: true,\n minPasswordLength: 8,\n maxPasswordLength: 128,\n requireEmailVerification: false,\n autoSignIn: true,\n },\n socialProviders: config.socialProviders?.google && {\n google: {\n ...config.socialProviders.google,\n // For local/preview env, redirect to production URL registered in Google Console\n ...(env.OAUTH_PROXY_PRODUCTION_URL && {\n redirectURI: `${env.OAUTH_PROXY_PRODUCTION_URL}/api/auth/callback/google`,\n }),\n },\n },\n session: {\n expiresIn: 60 * 60 * 24 * 7,\n updateAge: 60 * 60 * 24,\n cookieCache: {\n enabled: true,\n maxAge: 5 * 60,\n strategy: 'compact',\n },\n },\n advanced: {\n crossSubDomainCookies: {\n enabled: true,\n ...(cookieDomain && { domain: cookieDomain }),\n },\n defaultCookieAttributes: {\n sameSite: 'none',\n secure: true,\n httpOnly: true,\n partitioned: true,\n ...(cookieDomain && { domain: cookieDomain }),\n },\n ...config.advanced,\n },\n trustedOrigins: [\n 'http://localhost:3000',\n 'http://localhost:3002',\n env.INKEEP_AGENTS_MANAGE_UI_URL,\n env.INKEEP_AGENTS_MANAGE_API_URL,\n env.TRUSTED_ORIGIN,\n ].filter((origin): origin is string => typeof origin === 'string' && origin.length > 0),\n plugins: [\n bearer(),\n sso(),\n oAuthProxy({\n productionURL: env.OAUTH_PROXY_PRODUCTION_URL || config.baseURL,\n }),\n organization({\n allowUserToCreateOrganization: true,\n ac,\n roles: {\n member: memberRole,\n admin: adminRole,\n owner: ownerRole,\n },\n membershipLimit: 300,\n invitationLimit: 300,\n invitationExpiresIn: 7 * 24 * 60 * 60, // 7 days (in seconds)\n async sendInvitationEmail(data) {\n console.log('📧 Invitation created:', {\n email: data.email,\n invitedBy: data.inviter.user.name || data.inviter.user.email,\n organization: data.organization.name,\n invitationId: data.id,\n });\n\n // Note: The invitation link is displayed in the UI with a copy button.\n // If you want to send actual emails, configure an email provider:\n // - Resend: await resend.emails.send({ ... })\n // - SendGrid: await sgMail.send({ ... })\n // - AWS SES: await ses.sendEmail({ ... })\n // - Postmark: await postmark.sendEmail({ ... })\n },\n }),\n deviceAuthorization({\n verificationUri: '/device',\n expiresIn: '60m', // 30 minutes\n interval: '5s', // 5 second polling interval\n userCodeLength: 8, // e.g., \"ABCD-EFGH\"\n }),\n ],\n });\n\n if (config.ssoProviders?.length) {\n const providers = config.ssoProviders;\n setTimeout(async () => {\n for (const provider of providers) {\n await registerSSOProvider(config.dbClient, provider);\n }\n }, 1000);\n }\n\n return auth;\n}\n\n// Type placeholder for type inference in consuming code (e.g., app.ts AppVariables)\n// Actual auth instances should be created using createAuth() with a real database client\n// This is cast as any to avoid instantiation while preserving type information\nexport const auth = null as any as ReturnType<typeof createAuth>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA2FA,SAAS,oBAAoB,SAAqC;AAChE,KAAI;EAEF,MAAM,WADM,IAAI,IAAI,QAAQ,CACP;AAGrB,MAAI,aAAa,eAAe,SAAS,MAAM,uBAAuB,CACpE;EAIF,MAAM,QAAQ,SAAS,MAAM,IAAI;AAGjC,MAAI,MAAM,SAAS,EACjB;EASF,IAAIA;AACJ,MAAI,MAAM,WAAW,EAEnB,eAAc;WACL,MAAM,SAAS,EAExB,eAAc,MAAM,MAAM,EAAE;MAG5B,eAAc;AAGhB,SAAO,IAAI,YAAY,KAAK,IAAI;SAC1B;AACN;;;AAIJ,eAAe,oBACb,UACA,UACe;AACf,KAAI;AAOF,OANiB,MAAM,SACpB,QAAQ,CACR,KAAKC,YAAuB,CAC5B,MAAM,eAA0B,YAAY,SAAS,WAAW,CAAC,CACjE,MAAM,EAAE,EAEE,SAAS,EACpB;AAGF,MAAI,CAAC,SAAS,OACZ,OAAM,IAAI,MAAM,iBAAiB,SAAS,WAAW,sBAAsB;AAG7E,QAAM,SAAS,OAAOA,YAAuB,CAAC,OAAO;GACnD,IAAI,YAAY;GAChB,YAAY,SAAS;GACrB,QAAQ,SAAS;GACjB,QAAQ,SAAS;GACjB,YAAY,SAAS,aAAa,KAAK,UAAU,SAAS,WAAW,GAAG;GACxE,YAAY,SAAS,aAAa,KAAK,UAAU,SAAS,WAAW,GAAG;GACxE,QAAQ;GACR,gBAAgB,SAAS,kBAAkB;GAC5C,CAAC;UACK,OAAO;AACd,UAAQ,MAAM,sCAAsC,SAAS,WAAW,KAAK,MAAM;;;AAIvF,SAAgB,WAAW,QAA0B;CAEnD,MAAM,eAAe,oBAAoB,OAAO,QAAQ;CAExD,MAAMC,SAAO,WAAW;EACtB,SAAS,OAAO;EAChB,QAAQ,OAAO;EACf,UAAU,eAAe,OAAO,UAAU,EACxC,UAAU,MACX,CAAC;EACF,kBAAkB;GAChB,SAAS;GACT,mBAAmB;GACnB,mBAAmB;GACnB,0BAA0B;GAC1B,YAAY;GACb;EACD,iBAAiB,OAAO,iBAAiB,UAAU,EACjD,QAAQ;GACN,GAAG,OAAO,gBAAgB;GAE1B,GAAI,IAAI,8BAA8B,EACpC,aAAa,GAAG,IAAI,2BAA2B,4BAChD;GACF,EACF;EACD,SAAS;GACP,WAAW,OAAU,KAAK;GAC1B,WAAW,OAAU;GACrB,aAAa;IACX,SAAS;IACT,QAAQ;IACR,UAAU;IACX;GACF;EACD,UAAU;GACR,uBAAuB;IACrB,SAAS;IACT,GAAI,gBAAgB,EAAE,QAAQ,cAAc;IAC7C;GACD,yBAAyB;IACvB,UAAU;IACV,QAAQ;IACR,UAAU;IACV,aAAa;IACb,GAAI,gBAAgB,EAAE,QAAQ,cAAc;IAC7C;GACD,GAAG,OAAO;GACX;EACD,gBAAgB;GACd;GACA;GACA,IAAI;GACJ,IAAI;GACJ,IAAI;GACL,CAAC,QAAQ,WAA6B,OAAO,WAAW,YAAY,OAAO,SAAS,EAAE;EACvF,SAAS;GACP,QAAQ;GACR,KAAK;GACL,WAAW,EACT,eAAe,IAAI,8BAA8B,OAAO,SACzD,CAAC;GACF,aAAa;IACX,+BAA+B;IAC/B;IACA,OAAO;KACL,QAAQ;KACR,OAAO;KACP,OAAO;KACR;IACD,iBAAiB;IACjB,iBAAiB;IACjB,qBAAqB,QAAc;IACnC,MAAM,oBAAoB,MAAM;AAC9B,aAAQ,IAAI,0BAA0B;MACpC,OAAO,KAAK;MACZ,WAAW,KAAK,QAAQ,KAAK,QAAQ,KAAK,QAAQ,KAAK;MACvD,cAAc,KAAK,aAAa;MAChC,cAAc,KAAK;MACpB,CAAC;;IASL,CAAC;GACF,oBAAoB;IAClB,iBAAiB;IACjB,WAAW;IACX,UAAU;IACV,gBAAgB;IACjB,CAAC;GACH;EACF,CAAC;AAEF,KAAI,OAAO,cAAc,QAAQ;EAC/B,MAAM,YAAY,OAAO;AACzB,aAAW,YAAY;AACrB,QAAK,MAAM,YAAY,UACrB,OAAM,oBAAoB,OAAO,UAAU,SAAS;KAErD,IAAK;;AAGV,QAAOA;;AAMT,MAAa,OAAO"}
|
|
@@ -4,25 +4,25 @@ import { AccessControl } from "better-auth/plugins/access";
|
|
|
4
4
|
//#region src/auth/permissions.d.ts
|
|
5
5
|
declare const ac: AccessControl;
|
|
6
6
|
declare const memberRole: {
|
|
7
|
-
authorize<K_1 extends "function" | "organization" | "
|
|
8
|
-
actions: better_auth_plugins53.Subset<"function" | "organization" | "
|
|
7
|
+
authorize<K_1 extends "function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins53.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins53.Statements>[key] | {
|
|
8
|
+
actions: better_auth_plugins53.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins53.Statements>[key];
|
|
9
9
|
connector: "OR" | "AND";
|
|
10
10
|
} | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins53.AuthorizeResponse;
|
|
11
|
-
statements: better_auth_plugins53.Subset<"function" | "organization" | "
|
|
11
|
+
statements: better_auth_plugins53.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins53.Statements>;
|
|
12
12
|
};
|
|
13
13
|
declare const adminRole: {
|
|
14
|
-
authorize<K_1 extends "function" | "organization" | "
|
|
15
|
-
actions: better_auth_plugins53.Subset<"function" | "organization" | "
|
|
14
|
+
authorize<K_1 extends "function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins53.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins53.Statements>[key] | {
|
|
15
|
+
actions: better_auth_plugins53.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins53.Statements>[key];
|
|
16
16
|
connector: "OR" | "AND";
|
|
17
17
|
} | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins53.AuthorizeResponse;
|
|
18
|
-
statements: better_auth_plugins53.Subset<"function" | "organization" | "
|
|
18
|
+
statements: better_auth_plugins53.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins53.Statements>;
|
|
19
19
|
};
|
|
20
20
|
declare const ownerRole: {
|
|
21
|
-
authorize<K_1 extends "function" | "organization" | "
|
|
22
|
-
actions: better_auth_plugins53.Subset<"function" | "organization" | "
|
|
21
|
+
authorize<K_1 extends "function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins53.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins53.Statements>[key] | {
|
|
22
|
+
actions: better_auth_plugins53.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins53.Statements>[key];
|
|
23
23
|
connector: "OR" | "AND";
|
|
24
24
|
} | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins53.AuthorizeResponse;
|
|
25
|
-
statements: better_auth_plugins53.Subset<"function" | "organization" | "
|
|
25
|
+
statements: better_auth_plugins53.Subset<"function" | "organization" | "agent" | "project" | "tool" | "ac" | "member" | "sub_agent" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins53.Statements>;
|
|
26
26
|
};
|
|
27
27
|
//#endregion
|
|
28
28
|
export { ac, adminRole, memberRole, ownerRole };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permissions.d.ts","names":[],"sources":["../../src/auth/permissions.ts"],"sourcesContent":[],"mappings":";;;;cAwBa,IAAuC;cAEvC;;IAFA,OAAoD,8BAAA,CAAA,UAAA,GAAA,cAAA,GAAA,
|
|
1
|
+
{"version":3,"file":"permissions.d.ts","names":[],"sources":["../../src/auth/permissions.ts"],"sourcesContent":[],"mappings":";;;;cAwBa,IAAuC;cAEvC;;IAFA,OAAoD,8BAAA,CAAA,UAAA,GAAA,cAAA,GAAA,OAAA,GAAA,SAAA,GAAA,MAAA,GAAA,IAAA,GAAA,QAAA,GAAA,WAAA,GAAA,SAAA,GAAA,YAAA,GAAA,gBAAA,GAAA,oBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,YAAA,GAAA,MAAA,mCAAA,IAAA,CAAA;IAEpD,SAaX,EAAA,IAAA,GAAA,KAAA;;;;cAEW;;;;;;;cAeA;;;IAfA,SAaX,EAAA,IAAA,GAAA,KAAA"}
|
package/dist/client-exports.d.ts
CHANGED
|
@@ -177,8 +177,6 @@ declare const FullAgentDefinitionSchema: z.ZodObject<{
|
|
|
177
177
|
subAgents: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
|
|
178
178
|
id: z.ZodString;
|
|
179
179
|
name: z.ZodString;
|
|
180
|
-
createdAt: z.ZodOptional<z.ZodString>;
|
|
181
|
-
updatedAt: z.ZodOptional<z.ZodString>;
|
|
182
180
|
description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
183
181
|
models: z.ZodOptional<z.ZodObject<{
|
|
184
182
|
base: z.ZodOptional<z.ZodObject<{
|
|
@@ -203,6 +201,8 @@ declare const FullAgentDefinitionSchema: z.ZodObject<{
|
|
|
203
201
|
}, {
|
|
204
202
|
stepCountIs?: number | undefined;
|
|
205
203
|
}>>>>;
|
|
204
|
+
createdAt: z.ZodOptional<z.ZodString>;
|
|
205
|
+
updatedAt: z.ZodOptional<z.ZodString>;
|
|
206
206
|
conversationHistoryConfig: z.ZodOptional<z.ZodNullable<z.ZodType<ConversationHistoryConfig, ConversationHistoryConfig, z.core.$ZodTypeInternals<ConversationHistoryConfig, ConversationHistoryConfig>>>>;
|
|
207
207
|
type: z.ZodLiteral<"internal">;
|
|
208
208
|
canUse: z.ZodArray<z.ZodObject<{
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client-exports.d.ts","names":[],"sources":["../src/credential-stores/default-constants.ts","../src/client-exports.ts"],"sourcesContent":[],"mappings":";;;;;;;cAAa,sBAAA;;;;ACyDkB,cAAlB,kBAAkB,EAAA,CAAA,CAAA,SAAA,CAAA;EAAA,QAAA,aAAA;AAI/B,CAAA,eAAa,CAAA;cAAA,2BAAyB,CAAA,CAAA;;;CAAA,eAAA,CAAA;AAAA,cAIzB,2BAJyB,EAIE,CAAA,CAAA,SAJF,CAAA;EAIzB,QAAA,aAAA;;;;cAIA,gBAAc,CAAA,CAAA;EAJa,EAAA,aAAA;CAAA,eAAA,CAAA;AAI3B,cAIA,gBAFX,EAE2B,CAAA,CAAA,SAF3B,CAAA;;;EAFyB,KAAA,aAAA;EAAA,KAAA,aAAA;AAI3B,CAAA,eAAa,CAAA;cAOA,+BAAgC,CAAA,CAAE,wBAAwB,MAAC,CAAA,CAAA;;;;;;;EAP3C,CAAA,eAAA,CAAA;CAAA,eAAA,CAAA;AAOhB,cAMA,oBAFT,EAAA,CAAA,UAE2C,CAAA,CAAE,UAF7C,CAAA,CAAA,UAAA,EAEqE,CAFrE,EAAA,GAEsE,CAAA,CAAA,SAFtE,CAAA;EAJ2C,IAAA,GAAA;CAAwB,eAAA,CAAA;cAW1D,qBAAmB,CAAA,CAAA;;;;;cAQnB,sBAAoB,CAAA,CAAA;;;;;EAnBuC,KAAA,eAAA,YAAA,CAAA;IAAA,KAAA,eAAA,YAAA,CAAA;IAM3D,eAAA,eAGT,YAAA,YAAA,UAAA,CAAA,CAAA;EAH6C,CAAA,eAAA,CAAA,CAAA;EAAwB,KAAA,eAAA,WAAA,YAAA,CAAA,CAAA;;;EAAC,aAAA,eAAA,WAAA,YAAA,CAAA,CAAA;EAAA,aAAA,eAAA,WAAA,YAAA,CAAA,CAAA;EAK7D,IAAA,eAAA,UAIX,CAAA;;;;;cAkBW,qBAAmB,CAAA,CAAA;;EAtBA,IAAA,aAAA;EAAA,WAAA,eAAA,YAAA,CAAA;EAQnB,IAAA,WAAA,CAAA;;;;;;;cAuBA,uBAAqB,CAAA,CAAA;;;;;;;;;;;;;;cAerB,iCAA+B,CAAA,CAAA;;;;;;;;;;;;;;MAtCX,SAAA,aAAA;IAAA,CAAA,eAAA,CAAA;IAcpB,GAAA,aAAA;;;cA+BA,oCAAkC,CAAA,CAAA;;;;;;;;;;EA/Bf,iBAAA,aAAA;EAAA,eAAA,eAAA,cAAA,YAAA,YAAA,cAAA,CAAA,CAAA,CAAA;EASnB,SAAA,eAaX,YAAA,CAAA;;;;;;cAwBW,8BAA4B,CAAA,CAAA;;;;;;;;;;cAc5B,kCAAgC,CAAA,CAAA;EAnDX,EAAA,aAAA;EAAA,IAAA,aAAA;EAerB,WAAA,eAAA,cAKX,YAAA,CAAA,CAAA;;;;;;cAiCW,8BAA4B,CAAA,CAAA;;;;;;;cAQ5B,8BAA4B,CAAA,CAAA;;;;;;;;;AA9CG,cAwD/B,yBAxD+B,EAwDN,CAAA,CAAA,SAxDM,CAAA;EAAA,EAAA,eAAA,YAAA,CAAA;EAO/B,IAAA,aAAA;;;;cAwDA,2BAAyB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"client-exports.d.ts","names":[],"sources":["../src/credential-stores/default-constants.ts","../src/client-exports.ts"],"sourcesContent":[],"mappings":";;;;;;;cAAa,sBAAA;;;;ACyDkB,cAAlB,kBAAkB,EAAA,CAAA,CAAA,SAAA,CAAA;EAAA,QAAA,aAAA;AAI/B,CAAA,eAAa,CAAA;cAAA,2BAAyB,CAAA,CAAA;;;CAAA,eAAA,CAAA;AAAA,cAIzB,2BAJyB,EAIE,CAAA,CAAA,SAJF,CAAA;EAIzB,QAAA,aAAA;;;;cAIA,gBAAc,CAAA,CAAA;EAJa,EAAA,aAAA;CAAA,eAAA,CAAA;AAI3B,cAIA,gBAFX,EAE2B,CAAA,CAAA,SAF3B,CAAA;;;EAFyB,KAAA,aAAA;EAAA,KAAA,aAAA;AAI3B,CAAA,eAAa,CAAA;cAOA,+BAAgC,CAAA,CAAE,wBAAwB,MAAC,CAAA,CAAA;;;;;;;EAP3C,CAAA,eAAA,CAAA;CAAA,eAAA,CAAA;AAOhB,cAMA,oBAFT,EAAA,CAAA,UAE2C,CAAA,CAAE,UAF7C,CAAA,CAAA,UAAA,EAEqE,CAFrE,EAAA,GAEsE,CAAA,CAAA,SAFtE,CAAA;EAJ2C,IAAA,GAAA;CAAwB,eAAA,CAAA;cAW1D,qBAAmB,CAAA,CAAA;;;;;cAQnB,sBAAoB,CAAA,CAAA;;;;;EAnBuC,KAAA,eAAA,YAAA,CAAA;IAAA,KAAA,eAAA,YAAA,CAAA;IAM3D,eAAA,eAGT,YAAA,YAAA,UAAA,CAAA,CAAA;EAH6C,CAAA,eAAA,CAAA,CAAA;EAAwB,KAAA,eAAA,WAAA,YAAA,CAAA,CAAA;;;EAAC,aAAA,eAAA,WAAA,YAAA,CAAA,CAAA;EAAA,aAAA,eAAA,WAAA,YAAA,CAAA,CAAA;EAK7D,IAAA,eAAA,UAIX,CAAA;;;;;cAkBW,qBAAmB,CAAA,CAAA;;EAtBA,IAAA,aAAA;EAAA,WAAA,eAAA,YAAA,CAAA;EAQnB,IAAA,WAAA,CAAA;;;;;;;cAuBA,uBAAqB,CAAA,CAAA;;;;;;;;;;;;;;cAerB,iCAA+B,CAAA,CAAA;;;;;;;;;;;;;;MAtCX,SAAA,aAAA;IAAA,CAAA,eAAA,CAAA;IAcpB,GAAA,aAAA;;;cA+BA,oCAAkC,CAAA,CAAA;;;;;;;;;;EA/Bf,iBAAA,aAAA;EAAA,eAAA,eAAA,cAAA,YAAA,YAAA,cAAA,CAAA,CAAA,CAAA;EASnB,SAAA,eAaX,YAAA,CAAA;;;;;;cAwBW,8BAA4B,CAAA,CAAA;;;;;;;;;;cAc5B,kCAAgC,CAAA,CAAA;EAnDX,EAAA,aAAA;EAAA,IAAA,aAAA;EAerB,WAAA,eAAA,cAKX,YAAA,CAAA,CAAA;;;;;;cAiCW,8BAA4B,CAAA,CAAA;;;;;;;cAQ5B,8BAA4B,CAAA,CAAA;;;;;;;;;AA9CG,cAwD/B,yBAxD+B,EAwDN,CAAA,CAAA,SAxDM,CAAA;EAAA,EAAA,eAAA,YAAA,CAAA;EAO/B,IAAA,aAAA;;;;cAwDA,2BAAyB,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;MAxDS,WAAA,CAAA,EAAA,MAAA,GAAA,SAAA;IAAA,CAAA,EAAA;MAelC,WAAA,CAAA,EAAA,MAAA,GAYX,SAAA;;;;;;;;;;;;;;;;;MAZuC,CAAA,eAAA,CAAA,CAAA,CAAA,CAAA;IAAA,CAAA,eAAA,CAAA,CAAA;IAc5B,cAAA,eAAA,WAAiF,YAAA,CAAA,CAAA;;;;;;;;;;;;;;EAAjD,aAAA,eAAA,YAAA,CAAA;IAAA,EAAA,eAAA,YAAA,CAAA;IAEhC,IAAA,eAAA,YAMX,CAAA;;;;;;;;;;;;;;IANuC,UAAA,eAAA,YAAA,CAAA;MAAA,KAAA,aAAA;MAQ5B,eAAA,eAQX,YAAA,YAAA,aAAA,YAAA,cAAA,CAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;QARuC,QAAA,eAAA,WAAA,YAAA,CAAA,CAAA;MAAA,CAAA,eAAA,CAAA,CAAA;IAU5B,CAAA,eAAA,CAAA,CAAA,CAAA;;;KAmED,cAAA,GAAiB,CAAA,CAAE,aAAa;KAChC,aAAA,GAAgB,CAAA,CAAE,aAAa;KAC/B,iBAAA,GAAoB,CAAA,CAAE,aAAa;KACnC,eAAA,GAAkB,CAAA,CAAE,aAAa;KACjC,yBAAA,GAA4B,CAAA,CAAE,aAAa;KAC3C,uBAAA,GAA0B,CAAA,CAAE,aAAa;AAxEf,KAyE1B,4BAAA,GAA+B,CAAA,CAAE,KAzEP,CAAA,OAyEoB,kCAzEpB,CAAA;AAAA,KA0E1B,sBAAA,GAAyB,CAAA,CAAE,KA1ED,CAAA,OA0Ec,4BA1Ed,CAAA;AAOzB,KAoED,0BAAA,GAA6B,CAAA,CAAE,KAVzC,CAAA,OAUsD,gCAVtD,CAAA;KAWU,sBAAA,GAAyB,CAAA,CAAE,aAAa;KACxC,sBAAA,GAAyB,CAAA,CAAE,aAAa;KACxC,mBAAA,GAAsB,CAAA,CAAE,aAAa;KACrC,mBAAA,GAAsB,CAAA,CAAE,aAAa;KACrC,uBAAA,GAA0B,CAAA,CAAE,aAAa;KACzC,uBAAA,GAA0B,CAAA,CAAE,aAAa;KACzC,YAAA,GAAe,CAAA,CAAE,aAAa;KAC9B,aAAA,GAAgB,CAAA,CAAE,aAAa;cAE9B,aAAA;cACA,aAAA;cACA,qBAAmB;cAEnB,kBAAgB,CAAA,CAAA;iBAQb,kBAAA;KASJ,UAAA,GAAa;KACb,gBAAA,GAAmB"}
|