@isaijs/core 0.1.5 → 0.1.6

package/dist/auth/index.d.ts

@@ -1,3 +1,3 @@
 import { r as AuthTablesOptions } from "../data-layer-43pme0Gy.js";
-import { A as Permissions, F as Policy, I as Rules, L as StandardAction, M as Bound, N as DefinePolicy, P as Perms, a as OAuthMethod, c as Roles, i as Methods, j as AnyPolicy, l as SignInMethod, n as AuthConfig, o as Provider, r as AuthDefinition, s as RoleDefinition, t as Auth, u as createAuth } from "../index-D0FEnMhn.js";
+import { A as Permissions, F as Policy, I as Rules, L as StandardAction, M as Bound, N as DefinePolicy, P as Perms, a as OAuthMethod, c as Roles, i as Methods, j as AnyPolicy, l as SignInMethod, n as AuthConfig, o as Provider, r as AuthDefinition, s as RoleDefinition, t as Auth, u as createAuth } from "../index-a7ElyL3B.js";
 export { type AnyPolicy, Auth, type AuthConfig, type AuthDefinition, type AuthTablesOptions, type Bound, type DefinePolicy, type Methods, type OAuthMethod, type Permissions, type Perms, Policy, type Provider, type RoleDefinition, type Roles, type Rules, type SignInMethod, type StandardAction, createAuth };

package/dist/auth/index.js

@@ -1,3 +1,3 @@
 import { t as Policy } from "../policies-KsqmlX67.js";
-import { a as createAuth, t as Auth } from "../create-auth-BHdX68Ng.js";
+import { a as createAuth, t as Auth } from "../create-auth-BFKvQVOG.js";
 export { Auth, Policy, createAuth };

package/dist/{create-auth-BHdX68Ng.js → create-auth-BFKvQVOG.js}

@@ -23,8 +23,8 @@ var Auth = class {
 	perms = authPerms;
 	/** The policies made with this instance's `policy()`. */
 	policies = new PolicyRegistry();
-	/** Set by the app's core when it starts: `invite` on its current database. */
-	invites;
+	/** Set by the app's core when it starts: `invite` and `revoke` on its current database. */
+	people;
 	constructor(define) {
 		this.define = define;
 	}
@@ -34,12 +34,20 @@ var Auth = class {
 	* `held: "platform"` puts the assignment beyond the tenant's reach.
 	*/
 	invite(input) {
-		if (!this.invites) return Promise.reject(/* @__PURE__ */ new Error("isai: auth.invite is used before the runtime started the app"));
-		return this.invites(input);
+		if (!this.people) return Promise.reject(/* @__PURE__ */ new Error("isai: auth.invite is used before the runtime started the app"));
+		return this.people.invite(input);
 	}
-	/** The core's: where `invite` writes. */
-	attach(invites) {
-		this.invites = invites;
+	/**
+	* Takes a role from `email`, from code (replacing a tenant's owner): its invite to the role is
+	* deleted, and the role taken away if it has an account in the current database. Safe to repeat.
+	*/
+	revoke(input) {
+		if (!this.people) return Promise.reject(/* @__PURE__ */ new Error("isai: auth.revoke is used before the runtime started the app"));
+		return this.people.revoke(input);
+	}
+	/** The core's: where `invite` and `revoke` write. */
+	attach(people) {
+		this.people = people;
 	}
 	/** The config, for this env. Checked here for itself; against the databases by the core. */
 	resolve(env) {

package/dist/{index-D0FEnMhn.d.ts → index-a7ElyL3B.d.ts}

@@ -553,6 +553,11 @@ interface InviteInput {
   /** `"platform"`: the tenant's people can't take the role away. */
   readonly held?: (typeof HELD)[number];
 }
+/** What `auth.revoke` takes: an email, and the key of a role from `app.ts`. */
+interface RevokeInput {
+  readonly email: string;
+  readonly role: string;
+}
 //#endregion
 //#region src/auth/create-auth.d.ts
 type Provider = (typeof PROVIDERS)[number];
@@ -600,6 +605,11 @@ interface AuthConfig {
   /** Every permission key: every policy's actions, and `auth.perms`. */
   permissionKeys(): readonly string[];
 }
+/** `auth.invite` and `auth.revoke`, on the app's current database: the core's to attach. */
+interface AuthPeople {
+  invite(input: InviteInput): Promise<void>;
+  revoke(input: RevokeInput): Promise<void>;
+}
 declare class Auth<Env = unknown> {
   private readonly define;
   readonly perms: {
@@ -612,8 +622,8 @@ declare class Auth<Env = unknown> {
   };
   /** The policies made with this instance's `policy()`. */
   readonly policies: PolicyRegistry;
-  /** Set by the app's core when it starts: `invite` on its current database. */
-  private invites;
+  /** Set by the app's core when it starts: `invite` and `revoke` on its current database. */
+  private people;
   constructor(define: (env: Env) => AuthDefinition);
   /**
    * Gives `email` a role from `app.ts`, from code (a tenant's setup service, a seed): now, if it has
@@ -621,8 +631,13 @@ declare class Auth<Env = unknown> {
    * `held: "platform"` puts the assignment beyond the tenant's reach.
    */
   invite(input: InviteInput): Promise<void>;
-  /** The core's: where `invite` writes. */
-  attach(invites: (input: InviteInput) => Promise<void>): void;
+  /**
+   * Takes a role from `email`, from code (replacing a tenant's owner): its invite to the role is
+   * deleted, and the role taken away if it has an account in the current database. Safe to repeat.
+   */
+  revoke(input: RevokeInput): Promise<void>;
+  /** The core's: where `invite` and `revoke` write. */
+  attach(people: AuthPeople): void;
   /** The config, for this env. Checked here for itself; against the databases by the core. */
   resolve(env: Env): AuthConfig;
 }

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 import { p as Runtime, t as AppCore } from "./index-Ce5p2-EB.js";
-import { C as Params, D as RouteHandler, E as RouteContext, O as RouteOptions, R as Rejected, S as Method, T as RouteBuilder, _ as CustomAction, b as AppConfig, d as NotImplementedError, f as AppModules, g as createApp, h as CreatedApp, k as User, m as AppOptions, p as App, v as Resource, w as Route, x as Named, y as ResourceOptions, z as fail } from "./index-D0FEnMhn.js";
+import { C as Params, D as RouteHandler, E as RouteContext, O as RouteOptions, R as Rejected, S as Method, T as RouteBuilder, _ as CustomAction, b as AppConfig, d as NotImplementedError, f as AppModules, g as createApp, h as CreatedApp, k as User, m as AppOptions, p as App, v as Resource, w as Route, x as Named, y as ResourceOptions, z as fail } from "./index-a7ElyL3B.js";
 export { type App, type AppConfig, type AppCore, type AppModules, type AppOptions, type CreatedApp, type CustomAction, type Method, type Named, NotImplementedError, type Params, Rejected, type Resource, type ResourceOptions, Route, type RouteBuilder, type RouteContext, type RouteHandler, type RouteOptions, type Runtime, type User, createApp, fail };

package/dist/index.js

@@ -7,7 +7,7 @@ import { n as notImplemented, t as NotImplementedError } from "./errors-mCNLlXg9
 import { t as PLATFORM_PREFIX } from "./tables-DgSwge7s.js";
 import { t as Seed } from "./seed-BObmdKdP.js";
 import { d as afterUpdate, f as bindFor, h as ownerFieldOf, m as isFalse, p as check, u as FALSE } from "./policies-KsqmlX67.js";
-import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-BHdX68Ng.js";
+import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-BFKvQVOG.js";
 import { _ as permissionsOf, a as hashOf, b as syncRoles, c as GoogleError, f as verifyIdToken, g as safeReturn, h as redirect, i as clearedCookie, l as consentUrl, m as cookieOf, n as authModels, o as sessions, p as cookie, t as makers, u as exchangeCode, v as roleKeys, y as seedAs } from "./makers-P9kg68C8.js";
 import { t as WrongSize } from "./storage-body-7dWyMszh.js";
 import { RegExpRouter } from "hono/router/reg-exp-router";
@@ -2393,6 +2393,21 @@ async function invite(db, models, input) {
 		}
 	});
 }
+/**
+* `auth.revoke` from code, undoing `auth.invite`: the email's invite to the role is deleted, and if
+* it has an account here, the role is taken away (held by the platform or not). Its sessions stay,
+* with what its other roles allow. Safe to repeat. No permission or last-owner check: services are
+* trusted, so give the role to someone else first.
+*/
+async function revoke(db, models, input) {
+	const { User, Role, UserRole, Invite } = models;
+	const role = await db.findOne(Role, { key: input.role });
+	if (!role) throw new TypeError(`isai: auth.revoke takes the role "${input.role}", which app.ts's roles don't have`);
+	const invite = await db.findOne(Invite, { email: input.email });
+	if (invite?.role === role.id) await db.deleteOne(Invite, { id: invite.id });
+	const user = await db.findOne(User, { email: input.email });
+	if (user) await db.deleteMany(UserRole).where((h) => h.user.is(user.id)).where((h) => h.role.is(role.id));
+}
 //#endregion
 //#region src/auth/routes.ts
 /**
@@ -3139,7 +3154,10 @@ function createCore(config, env, options = {}) {
 		checkRoles(auth, config.tenancy.roles, "tenancy.roles");
 	}
 	const models = auth ? authModels(auth.user) : void 0;
-	if (models) config.auth?.attach((input) => invite(currentDb(), models, input));
+	if (models) config.auth?.attach({
+		invite: (input) => invite(currentDb(), models, input),
+		revoke: (input) => revoke(currentDb(), models, input)
+	});
 	const single = named.kind === "database" ? database({
 		driver: named,
 		name,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isaijs/core",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "A batteries-included, type-safe TypeScript backend framework. Cloudflare first, no lock-in.",
   "type": "module",
   "license": "MIT",