@intelligo-dev/auth 1.0.0-beta.1

package/dist/workspace/service.js

@@ -0,0 +1,268 @@
+/**
+ * Workspace management service — the durable business rules behind
+ * workspace listing, creation, switching, editing and deletion,
+ * extracted from the product application's workspace actions (page/
+ * registry migration, `workspace-settings` family, roadmap item 8).
+ *
+ * Mirrors `createTeamService(ports)` (./../team/service.ts) one
+ * directory over: a factory over optional ports, so this package's
+ * allowlisted dependency (`@intelligo-dev/core` only — see
+ * tests/architecture/dependency-direction.test.ts) never grows to
+ * include billing. A consumer binds that in at its composition root:
+ *
+ *   const workspaceService = createWorkspaceService({
+ *     checkWorkspaceLimit: ...,   // adapts @intelligo-dev/billing's checkPlanLimit
+ *   });
+ *
+ * Authorization (`requireAuth`/`requireWorkspace`/`requireRole`) lives
+ * INSIDE each method, not at the transport. Every recognized failure
+ * throws `WorkspaceServiceError` with a stable `code` — no
+ * revalidatePath/Sentry/next-intl/toast here; that shaping is the
+ * transport's job (a Server Action, a route handler).
+ *
+ * ---------------------------------------------------------------------
+ * Why `checkWorkspaceLimit` takes a `userId`, not a `workspaceId`
+ * ---------------------------------------------------------------------
+ * `createWorkspace` has no workspace to check the plan of yet — it is
+ * the thing being created. Ignite's original action worked around this
+ * by reading the caller's *existing* workspaces and using the first
+ * one's id to look up a plan via `@intelligo-dev/billing`'s
+ * `checkPlanLimit(workspaceId, "workspaces", currentCount)`, i.e. it
+ * borrowed an arbitrary existing workspace's subscription as a stand-in
+ * for "the caller's plan". That borrowing is a binding-layer concern,
+ * not a service-layer one: this service only knows the caller's
+ * `userId` and how many workspaces they already have. The composition
+ * root's binding (`checkWorkspaceLimit`) is where a consumer decides
+ * how to resolve "this user's plan" — by reading their first workspace
+ * the same way ignite did, or by a real per-user plan lookup if one
+ * exists.
+ *
+ * ---------------------------------------------------------------------
+ * The two Better-Auth pitfalls (already solved in ../team/service.ts —
+ * copied here rather than re-derived)
+ * ---------------------------------------------------------------------
+ * 1. Method-name mismatch: the typed `orgApi` wrapper (../org-api.ts)
+ *    exists precisely because `auth.api`'s organization-plugin methods
+ *    are keyed by their own camelCase *server* id, which does not
+ *    always match the HTTP path or the client SDK name. This service
+ *    uses `orgApi["/organization/list"]` and
+ *    `orgApi["/organization/set-active"]` for the two calls the
+ *    wrapper covers, and calls `auth.api.{createOrganization,
+ *    updateOrganization, deleteOrganization, getFullOrganization}`
+ *    directly for the base organization CRUD surface, which is not
+ *    part of `orgApi`'s typed table (the same approach
+ *    `../team/service.ts` takes for `getFullOrganization`). Ignite's
+ *    original `actions/workspace.ts` already called these four by
+ *    their correct `auth.api` names directly (it never went through a
+ *    path-keyed cast), so there is no method-name bug to fix here.
+ * 2. `sessions.activeOrganizationId` does not exist on this repo's
+ *    Drizzle schema. Ignite's original `getActiveWorkspace()` called
+ *    `auth.api.getFullOrganization({ headers })` with no
+ *    `organizationId` — the exact bug documented in
+ *    `../team/service.ts`'s module comment: that resolves to *no*
+ *    organization regardless of what the caller most recently
+ *    activated. This service's `getActiveWorkspace` instead resolves
+ *    the caller's workspace via `requireWorkspace()` first (which has
+ *    its own explicit-id fallback) and passes that id explicitly to
+ *    `getFullOrganization`.
+ */
+import { headers } from "next/headers";
+import { createLogger } from "@intelligo-dev/core/logger";
+import { auth } from "../server";
+import { requireAuth, requireRole, requireWorkspace } from "../helpers";
+import { orgApi } from "../org-api";
+import { createWorkspaceSchema, updateWorkspaceSchema, } from "./schemas";
+import { WorkspaceServiceError, isWorkspaceServiceError } from "./errors";
+const log = createLogger("WorkspaceService");
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Maps requireAuth/requireWorkspace/requireRole failures to `forbidden`. */
+function toForbidden(error) {
+    if (isWorkspaceServiceError(error))
+        return error;
+    return new WorkspaceServiceError("forbidden", errorMessage(error), {
+        cause: error,
+    });
+}
+function parseInput(schema, input) {
+    const result = schema.safeParse(input);
+    if (!result.success) {
+        throw new WorkspaceServiceError("invalid_input", result.error.issues.map((issue) => issue.message).join("; ") ||
+            "Invalid input", { cause: result.error });
+    }
+    return result.data;
+}
+/** Derives a URL-safe slug base from a workspace name. */
+function slugify(name) {
+    return name
+        .toLowerCase()
+        .replace(/[^a-z0-9-]/g, "-")
+        .replace(/-+/g, "-")
+        .slice(0, 50);
+}
+export function createWorkspaceService(ports = {}) {
+    async function callRequireAuth() {
+        try {
+            return await requireAuth();
+        }
+        catch (error) {
+            throw toForbidden(error);
+        }
+    }
+    async function callRequireWorkspace() {
+        try {
+            return await requireWorkspace();
+        }
+        catch (error) {
+            throw toForbidden(error);
+        }
+    }
+    async function callRequireRole(allowedRoles) {
+        try {
+            return await requireRole(allowedRoles);
+        }
+        catch (error) {
+            throw toForbidden(error);
+        }
+    }
+    /** Wraps a Better-Auth org-plugin call; unrecognized failures become `provider_error`. */
+    async function callOrgApi(context, fn) {
+        try {
+            return await fn();
+        }
+        catch (error) {
+            if (isWorkspaceServiceError(error))
+                throw error;
+            log.error("Org API call failed", { context, error: errorMessage(error) });
+            throw new WorkspaceServiceError("provider_error", `Better-Auth organization API call failed (${context})`, { cause: error });
+        }
+    }
+    /**
+     * List all workspaces for the current user.
+     */
+    async function listWorkspaces() {
+        await callRequireAuth();
+        const hdrs = await headers();
+        const orgs = await callOrgApi("list", () => orgApi["/organization/list"]({ headers: hdrs }));
+        return orgs ?? [];
+    }
+    /**
+     * Create a new workspace. Auto-generates a slug from the name if not
+     * provided, and appends a uniqueness suffix (Better-Auth requires
+     * unique slugs). The caller's first workspace is always allowed; the
+     * limit port, when bound, gates every workspace after that. The new
+     * workspace is auto-activated on success.
+     */
+    async function createWorkspace(input) {
+        const { user } = await callRequireAuth();
+        const validated = parseInput(createWorkspaceSchema, input);
+        const hdrs = await headers();
+        const existing = await callOrgApi("list", () => orgApi["/organization/list"]({ headers: hdrs }));
+        const existingCount = existing?.length ?? 0;
+        if (ports.checkWorkspaceLimit && existingCount > 0) {
+            const limitCheck = await ports.checkWorkspaceLimit(user.id, existingCount);
+            if (!limitCheck.allowed) {
+                throw new WorkspaceServiceError("workspace_limit_reached", `Your plan allows up to ${limitCheck.limit} workspace${limitCheck.limit === 1 ? "" : "s"}. Upgrade to create more workspaces.`, { meta: { limit: limitCheck.limit } });
+            }
+        }
+        const slugBase = validated.slug || slugify(validated.name);
+        // Append timestamp for uniqueness (Better-Auth requires unique slugs).
+        const slug = `${slugBase}-${Date.now().toString(36)}`;
+        const org = (await callOrgApi("create", () => auth.api.createOrganization({
+            headers: hdrs,
+            body: { name: validated.name, slug },
+        })));
+        if (!org) {
+            throw new WorkspaceServiceError("provider_error", "Failed to create workspace");
+        }
+        await callOrgApi("set-active", () => orgApi["/organization/set-active"]({
+            headers: hdrs,
+            body: { organizationId: org.id },
+        }));
+        return org;
+    }
+    /**
+     * Switch the caller's active workspace.
+     */
+    async function switchWorkspace(organizationId) {
+        await callRequireAuth();
+        if (typeof organizationId !== "string" || organizationId.length === 0) {
+            throw new WorkspaceServiceError("invalid_input", "Invalid workspace id");
+        }
+        const hdrs = await headers();
+        await callOrgApi("set-active", () => orgApi["/organization/set-active"]({
+            headers: hdrs,
+            body: { organizationId },
+        }));
+    }
+    /**
+     * Update workspace settings (name/slug/logo). Owner/admin only.
+     */
+    async function updateWorkspace(input) {
+        const { workspace } = await callRequireRole(["owner", "admin"]);
+        const validated = parseInput(updateWorkspaceSchema, input);
+        const hdrs = await headers();
+        const updateData = {};
+        if (validated.name)
+            updateData.name = validated.name;
+        if (validated.slug)
+            updateData.slug = validated.slug;
+        if (validated.logo)
+            updateData.logo = validated.logo;
+        const result = (await callOrgApi("update", () => auth.api.updateOrganization({
+            headers: hdrs,
+            body: { data: updateData, organizationId: workspace.id },
+        })));
+        if (!result) {
+            throw new WorkspaceServiceError("provider_error", "Failed to update workspace");
+        }
+        return result;
+    }
+    /**
+     * Delete the caller's active workspace. Owner only. Switches the
+     * caller to another workspace afterward, if one remains.
+     */
+    async function deleteWorkspace() {
+        const { workspace } = await callRequireRole(["owner"]);
+        const hdrs = await headers();
+        await callOrgApi("delete", () => auth.api.deleteOrganization({
+            headers: hdrs,
+            body: { organizationId: workspace.id },
+        }));
+        const orgs = await callOrgApi("list", () => orgApi["/organization/list"]({ headers: hdrs }));
+        if (orgs && orgs.length > 0) {
+            await callOrgApi("set-active", () => orgApi["/organization/set-active"]({
+                headers: hdrs,
+                body: { organizationId: orgs[0].id },
+            }));
+        }
+    }
+    /**
+     * Get the caller's active workspace, fully resolved. Unlike
+     * ignite's original (see the module doc comment), this resolves the
+     * workspace id explicitly via `requireWorkspace()` rather than
+     * relying on a non-existent `sessions.activeOrganizationId` fallback.
+     */
+    async function getActiveWorkspace() {
+        const { workspace } = await callRequireWorkspace();
+        const hdrs = await headers();
+        const org = (await callOrgApi("getFullOrganization", () => auth.api.getFullOrganization({
+            headers: hdrs,
+            query: { organizationId: workspace.id },
+        })));
+        if (!org) {
+            throw new WorkspaceServiceError("not_found", "Workspace not found");
+        }
+        return org;
+    }
+    return {
+        listWorkspaces,
+        createWorkspace,
+        switchWorkspace,
+        updateWorkspace,
+        deleteWorkspace,
+        getActiveWorkspace,
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/workspace/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/workspace/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,MAAM,EAAoB,MAAM,YAAY,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GAGtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAE1E,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;AA0B7C,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,uBAAuB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,IAAI,qBAAqB,CAAC,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE;QACjE,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAI,MAAkB,EAAE,KAAc;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,qBAAqB,CAC7B,eAAe,EACf,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1D,eAAe,EACjB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,0DAA0D;AAC1D,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAA+B,EAAE;IACtE,KAAK,UAAU,eAAe;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,UAAU,oBAAoB;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,gBAAgB,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,YAAiD;QAEjD,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,EAAoB;QAEpB,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,uBAAuB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAChD,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1E,MAAM,IAAI,qBAAqB,CAC7B,gBAAgB,EAChB,6CAA6C,OAAO,GAAG,EACvD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,cAAc;QAC3B,MAAM,eAAe,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAChD,CAAC;QAEF,OAAO,IAAI,IAAI,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,eAAe,CAC5B,KAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAC7C,MAAM,CAAC,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,aAAa,GAAG,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;QAE5C,IAAI,KAAK,CAAC,mBAAmB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAChD,IAAI,CAAC,EAAE,EACP,aAAa,CACd,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,qBAAqB,CAC7B,yBAAyB,EACzB,0BAA0B,UAAU,CAAC,KAAK,aACxC,UAAU,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAChC,sCAAsC,EACtC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,CACtC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3D,uEAAuE;QACvE,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAEtD,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC3C,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE;SACrC,CAAC,CACH,CAA2B,CAAC;QAE7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,qBAAqB,CAC7B,gBAAgB,EAChB,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,CAAC,YAAY,EAAE,GAAG,EAAE,CAClC,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE;SACjC,CAAC,CACH,CAAC;QAEF,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,eAAe,CAAC,cAAsB;QACnD,MAAM,eAAe,EAAE,CAAC;QAExB,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,qBAAqB,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,UAAU,CAAC,YAAY,EAAE,GAAG,EAAE,CAClC,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,cAAc,EAAE;SACzB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,eAAe,CAC5B,KAA2B;QAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,UAAU,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,UAAU,GAAoD,EAAE,CAAC;QACvE,IAAI,SAAS,CAAC,IAAI;YAAE,UAAU,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QACrD,IAAI,SAAS,CAAC,IAAI;YAAE,UAAU,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QACrD,IAAI,SAAS,CAAC,IAAI;YAAE,UAAU,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QAErD,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC9C,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;SACzD,CAAC,CACH,CAA2B,CAAC;QAE7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,qBAAqB,CAC7B,gBAAgB,EAChB,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,eAAe;QAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC9B,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;SACvC,CAAC,CACH,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAChD,CAAC;QACF,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,UAAU,CAAC,YAAY,EAAE,GAAG,EAAE,CAClC,MAAM,CAAC,0BAA0B,CAAC,CAAC;gBACjC,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE;aACtC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,kBAAkB;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,qBAAqB,EAAE,GAAG,EAAE,CACxD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;SACxC,CAAC,CACH,CAA2B,CAAC;QAE7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,cAAc;QACd,eAAe;QACf,eAAe;QACf,eAAe;QACf,eAAe;QACf,kBAAkB;KACnB,CAAC;AACJ,CAAC"}

package/dist/workspace-init.js

@@ -0,0 +1,121 @@
+/**
+ * Workspace Initialization
+ *
+ * Ensures every authenticated user has at least one workspace.
+ * Called from the (app) layout to guarantee workspace exists.
+ * Idempotent - safe to call on every page load.
+ *
+ * Pattern: "Belt-and-suspenders" approach consistent with Phase 9.
+ * Better-Auth doesn't provide a reliable hook for post-signup workspace creation,
+ * so we check + create on every authenticated page load.
+ *
+ * Dependency Inversion (Phase 42, PKG-01 preparation):
+ * Post-creation logic (e.g., trial provisioning) is injected via callback,
+ * so this module has ZERO billing imports. The actual billing call lives
+ * in the consumer application's authenticated layout, which already
+ * imports billing.
+ * This breaks the auth → billing circular dependency before Phase 43 extraction.
+ */
+import { auth } from "./server";
+import { createLogger } from "@intelligo-dev/core/logger";
+const log = createLogger("WorkspaceInit");
+/**
+ * Ensure user has at least one workspace (WORK-01).
+ *
+ * If user has organizations, sets the first as active. If none exist,
+ * creates a personal workspace — this serves as a fallback in case the
+ * user.create hook (server.ts databaseHooks) hasn't completed yet, and
+ * also handles users created via non-Better-Auth flows (e.g. admin panel).
+ *
+ * Idempotent - safe to call repeatedly. Returns quickly if workspace exists.
+ *
+ * @param user - Authenticated user from session
+ * @param headers - Request headers (required for Better-Auth API)
+ * @param options.onWorkspaceCreated - Optional callback invoked after a new workspace is created.
+ *   Receives workspaceId and email. Failure does NOT block workspace creation (same fire-and-forget
+ *   behavior as the previous inline trial provisioning call).
+ * @returns The organization ID that was set as active (useful for immediate access before session updates)
+ */
+export async function ensureUserWorkspace(user, headers, options) {
+    log.info("Starting workspace check", { email: user.email });
+    // Check if user has any organizations
+    const orgs = await auth.api.listOrganizations({
+        headers,
+    });
+    log.info("Found organizations", { count: orgs?.length ?? 0 });
+    if (orgs && orgs.length > 0 && orgs[0]) {
+        log.debug("User has workspaces, setting first as active");
+        // User has workspaces - ensure one is active
+        try {
+            await auth.api.setActiveOrganization({
+                headers,
+                body: { organizationId: orgs[0].id },
+            });
+            log.info("Set active organization", { orgId: orgs[0].id });
+        }
+        catch (error) {
+            log.error("Failed to set active organization", {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw error;
+        }
+        return orgs[0].id;
+    }
+    // TR-DB03 fix: No organizations found — the user.create hook may not have
+    // completed yet, or user was created via a non-Better-Auth flow.
+    // Create the workspace here as a fallback rather than throwing.
+    // Idempotent: the unique constraint on organization.slug prevents duplicates
+    // if both this fallback and the hook fire for the same signup.
+    log.warn("No workspace found, creating one (hook may still fire)", {
+        email: user.email,
+    });
+    const slug = ((user.email || "user").split("@")[0] || "user")
+        .toLowerCase()
+        .replace(/[^a-z0-9-]/g, "-")
+        .slice(0, 30);
+    let workspaceId;
+    try {
+        const result = await auth.api.createOrganization({
+            headers,
+            body: {
+                name: `${user.name || "User"}'s Workspace`,
+                slug: `${slug}-${Date.now().toString(36)}`,
+                userId: user.id,
+            },
+        });
+        if (!result) {
+            throw new Error("createOrganization returned no result");
+        }
+        workspaceId = result.id;
+        log.info("Created fallback workspace", { workspaceId });
+    }
+    catch (error) {
+        // If creation failed because the unique constraint was hit (hook already
+        // created), the error message contains the duplicate key info.
+        // List orgs again — if one now exists, use it.
+        const orgsAfter = await auth.api.listOrganizations({ headers });
+        if (orgsAfter && orgsAfter.length > 0 && orgsAfter[0]) {
+            log.info("Workspace created concurrently by hook, using it");
+            await auth.api.setActiveOrganization({
+                headers,
+                body: { organizationId: orgsAfter[0].id },
+            });
+            return orgsAfter[0].id;
+        }
+        // Genuine failure
+        log.error("Failed to create fallback workspace", {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        throw error;
+    }
+    // Fire the optional callback (trial credits, referral tracking, etc.)
+    if (options?.onWorkspaceCreated) {
+        options
+            .onWorkspaceCreated({ workspaceId, email: user.email })
+            .catch((err) => log.error("onWorkspaceCreated callback failed", {
+            error: err instanceof Error ? err.message : String(err),
+        }));
+    }
+    return workspaceId;
+}
+//# sourceMappingURL=workspace-init.js.map

package/dist/workspace-init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-init.js","sourceRoot":"","sources":["../src/workspace-init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAU,EACV,OAAgB,EAChB,OAKC;IAED,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAE5D,sCAAsC;IACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,OAAO;KACR,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IAE9D,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC1D,6CAA6C;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBACnC,OAAO;gBACP,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;aACrC,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE;gBAC7C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpB,CAAC;IAED,0EAA0E;IAC1E,iEAAiE;IACjE,gEAAgE;IAChE,6EAA6E;IAC7E,+DAA+D;IAC/D,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE;QACjE,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;SAC1D,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC/C,OAAO;YACP,IAAI,EAAE;gBACJ,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,cAAc;gBAC1C,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;gBAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;aAChB;SACF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,+DAA+D;QAC/D,+CAA+C;QAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBACnC,OAAO;gBACP,IAAI,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,CAAC;QACD,kBAAkB;QAClB,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE;YAC/C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAChC,OAAO;aACJ,kBAAkB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;aACtD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,GAAG,CAAC,KAAK,CAAC,oCAAoC,EAAE;YAC9C,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CACH,CAAC;IACN,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@intelligo-dev/auth",
+  "version": "1.0.0-beta.1",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/intelligo-mn/framework.git",
+    "directory": "packages/auth"
+  },
+  "homepage": "https://github.com/intelligo-mn/framework#readme",
+  "bugs": {
+    "url": "https://github.com/intelligo-mn/framework/issues"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "default": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./src/client.ts",
+      "default": "./dist/client.js"
+    },
+    "./edge": {
+      "types": "./src/edge.ts",
+      "default": "./dist/edge.js"
+    }
+  },
+  "dependencies": {
+    "better-auth": "~1.6.30",
+    "drizzle-orm": "^0.45.1",
+    "server-only": "^0.0.1",
+    "zod": "^3.24.1",
+    "@intelligo-dev/core": "1.0.0-beta.1"
+  },
+  "peerDependencies": {
+    "next": "^15.0.0 || ^16.0.0"
+  },
+  "devDependencies": {
+    "@types/react": "^19.0.10",
+    "next": "^16.0.7",
+    "typescript": "^5.7.2"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "type-check": "tsc --noEmit",
+    "lint": "eslint .",
+    "build": "tsc -p tsconfig.build.json"
+  }
+}

package/src/client.ts

@@ -0,0 +1,27 @@
+/**
+ * Better-Auth Client
+ *
+ * Client-side authentication utilities for React components.
+ * This module uses "better-auth/react" which is a client-side module.
+ *
+ * IMPORTANT: Only import this in "use client" components.
+ * For server-side auth, use @intelligo-dev/auth (server.ts)
+ */
+
+import { createAuthClient } from "better-auth/react";
+import { organizationClient } from "better-auth/client/plugins";
+
+// No `baseURL`: the client and the Better-Auth server always live on the
+// same origin (this app's own `/api/auth/*` routes), so Better-Auth's
+// client defaults to `window.location.origin` and every request is
+// same-origin. Do not reintroduce an absolute `NEXT_PUBLIC_APP_URL`
+// baseURL here — the dev port has drifted before (3000 -> 3001 -> 4000)
+// and an absolute cross-origin URL is blocked by the app's CSP
+// (`connect-src 'self'`) whenever it doesn't match the port the app is
+// actually served on.
+export const authClient = createAuthClient({
+  plugins: [organizationClient()],
+});
+
+// Export commonly used hooks and methods for convenience
+export const { useSession, signIn, signUp, signOut } = authClient;

package/src/edge.ts

@@ -0,0 +1,43 @@
+/**
+ * Edge-safe session presence check.
+ *
+ * Middleware runs in the Edge Runtime, where no TCP Postgres driver is
+ * available. The previous version of this module solved that by
+ * instantiating Better-Auth against the Neon HTTP driver — which made
+ * middleware silently Neon-only. Against any other Postgres the session
+ * query failed with `TypeError: fetch failed`, Better-Auth turned that
+ * into `APIError: Failed to get session`, and the middleware threw: every
+ * request to the app returned HTTP 500. The old code hid this behind a
+ * `NODE_ENV === "development"` bypass that skipped auth entirely, so the
+ * failure only appeared in a production build on a non-Neon database.
+ *
+ * The fix is to stop querying the database from the edge at all.
+ * Middleware performs an OPTIMISTIC check: it reads the session cookie
+ * and decides where to send the request. It never asserts that the
+ * session is valid.
+ *
+ * The authoritative check stays server-side, where it always was —
+ * `requireAuth`/`requireWorkspace`/`requireRole` and the authenticated
+ * layout's own `getAuthSession()` redirect. A forged or expired cookie
+ * gets past middleware and is then rejected by the page or action that
+ * actually reads data. This is the pattern Better-Auth documents for
+ * Next.js middleware, and it is what makes the guard work on any
+ * Postgres, in any runtime, with one code path in every environment.
+ */
+
+import { getSessionCookie } from "better-auth/cookies";
+
+/**
+ * True when the request carries a Better-Auth session cookie.
+ *
+ * Presence only — the cookie's signature is NOT verified and no
+ * database read happens. Never use this to authorize access to data;
+ * use it to choose a redirect. Authorization belongs to `requireAuth`
+ * and friends, which run in the Node runtime against the real session.
+ */
+export function hasSessionCookie(request: Request): boolean {
+  return getSessionCookie(request) !== null;
+}
+
+// Re-export for edge routes that reason about workspace roles.
+export { type WorkspaceRole } from "./helpers";