@keystrokehq/platform 0.0.136 → 0.0.137

package/dist/run.cjs

@@ -1,5 +1,5 @@
 const require_config = require("./config.cjs");
-const require_start = require("./start-AL_o2HoK.cjs");
+const require_start = require("./start-BuRTgJlJ.cjs");
 //#region src/run.ts
 async function main() {
 	await require_start.startPlatformServer(require_config.definePlatformConfig());

package/dist/run.mjs

@@ -1,5 +1,5 @@
 import { definePlatformConfig } from "./config.mjs";
-import { t as startPlatformServer } from "./start-pFr_c6SD.mjs";
+import { t as startPlatformServer } from "./start-yehsjk2a.mjs";
 //#region src/run.ts
 async function main() {
 	await startPlatformServer(definePlatformConfig());

package/dist/{start-AL_o2HoK.cjs → start-BuRTgJlJ.cjs}

@@ -2,15 +2,17 @@ const require_dist = require("./dist-CT6EPgxh.cjs");
 const require_dist$1 = require("./dist-CfpZlJ5K.cjs");
 const require_dist$2 = require("./dist-CVHjeM1T.cjs");
 let zod = require("zod");
+zod = require_dist.__toESM(zod, 1);
 let _hono_node_server = require("@hono/node-server");
 let _better_auth_drizzle_adapter = require("@better-auth/drizzle-adapter");
 let better_auth = require("better-auth");
 let better_auth_plugins_bearer = require("better-auth/plugins/bearer");
 let better_auth_plugins_device_authorization = require("better-auth/plugins/device-authorization");
 let better_auth_plugins = require("better-auth/plugins");
+let node_async_hooks = require("node:async_hooks");
+let better_auth_api = require("better-auth/api");
 let better_auth_plugins_magic_link = require("better-auth/plugins/magic-link");
 let resend = require("resend");
-let node_async_hooks = require("node:async_hooks");
 let hono = require("hono");
 let hono_cors = require("hono/cors");
 //#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -1295,6 +1297,78 @@ function createAuthDatabaseAdapter() {
 }
 //#endregion
 //#region ../../packages/auth/dist/index.mjs
+function normalizeUserCode(userCode) {
+	return userCode.replace(/-/g, "");
+}
+function createCliDeviceOrganizationPlugin() {
+	return {
+		id: "cli-device-organization",
+		endpoints: { attachOrganization: (0, better_auth_api.createAuthEndpoint)("/device/attach-organization", {
+			method: "POST",
+			body: zod.object({
+				userCode: zod.string(),
+				organizationId: zod.string()
+			}),
+			requireHeaders: true
+		}, async (ctx) => {
+			const session = await (0, better_auth_api.getSessionFromCtx)(ctx);
+			if (!session) throw new better_auth_api.APIError("UNAUTHORIZED", {
+				error: "unauthorized",
+				error_description: "Authentication required"
+			});
+			const organizationId = ctx.body.organizationId.trim();
+			if (!organizationId) throw new better_auth_api.APIError("BAD_REQUEST", {
+				error: "invalid_request",
+				error_description: "Organization id is required"
+			});
+			if (!await require_dist$2.selectUserOrganizationMembership(session.user.id, organizationId)) throw new better_auth_api.APIError("FORBIDDEN", {
+				error: "access_denied",
+				error_description: "You are not a member of this organization"
+			});
+			const cleanUserCode = normalizeUserCode(ctx.body.userCode);
+			const deviceCodeRecord = await ctx.context.adapter.findOne({
+				model: "deviceCode",
+				where: [{
+					field: "userCode",
+					value: cleanUserCode
+				}]
+			});
+			if (!deviceCodeRecord) throw new better_auth_api.APIError("BAD_REQUEST", {
+				error: "invalid_request",
+				error_description: "Invalid device user code"
+			});
+			if (deviceCodeRecord.expiresAt < /* @__PURE__ */ new Date()) throw new better_auth_api.APIError("BAD_REQUEST", {
+				error: "expired_token",
+				error_description: "Device user code has expired"
+			});
+			if (deviceCodeRecord.status !== "pending") throw new better_auth_api.APIError("BAD_REQUEST", {
+				error: "invalid_request",
+				error_description: "Device authorization has already been processed"
+			});
+			if (deviceCodeRecord.clientId && deviceCodeRecord.clientId !== "keystroke-cli") throw new better_auth_api.APIError("BAD_REQUEST", {
+				error: "invalid_request",
+				error_description: "Invalid device client"
+			});
+			if (!deviceCodeRecord.userId) throw new better_auth_api.APIError("BAD_REQUEST", {
+				error: "invalid_request",
+				error_description: "Device authorization has not been claimed yet"
+			});
+			if (deviceCodeRecord.userId !== session.user.id) throw new better_auth_api.APIError("FORBIDDEN", {
+				error: "access_denied",
+				error_description: "You are not authorized to update this device authorization"
+			});
+			await ctx.context.adapter.update({
+				model: "deviceCode",
+				where: [{
+					field: "id",
+					value: deviceCodeRecord.id
+				}],
+				update: { scope: organizationId }
+			});
+			return ctx.json({ success: true });
+		}) }
+	};
+}
 function envValue$1(name) {
 	return process.env[name]?.trim() || void 0;
 }
@@ -1430,6 +1504,7 @@ function createAuthInstance(options) {
 				interval: "1s",
 				schema: {}
 			}),
+			createCliDeviceOrganizationPlugin(),
 			(0, better_auth_plugins_bearer.bearer)(),
 			(0, better_auth_plugins.jwt)({ jwt: { definePayload: ({ user }) => ({
 				id: user.id,
@@ -3668,4 +3743,4 @@ Object.defineProperty(exports, "startPlatformServer", {
 	}
 });
 
-//# sourceMappingURL=start-AL_o2HoK.cjs.map
+//# sourceMappingURL=start-BuRTgJlJ.cjs.map