@keystrokehq/platform 0.0.146 → 0.0.147

package/dist/run.cjs

@@ -1,5 +1,5 @@
 const require_config = require("./config.cjs");
-const require_start = require("./start-Btbz1V6t.cjs");
+const require_start = require("./start-BHOssHdU.cjs");
 //#region src/run.ts
 async function main() {
 	await require_start.startPlatformServer(require_config.definePlatformConfig());

package/dist/run.mjs

@@ -1,5 +1,5 @@
 import { definePlatformConfig } from "./config.mjs";
-import { t as startPlatformServer } from "./start-DtoXNgY3.mjs";
+import { t as startPlatformServer } from "./start-C-an8T-8.mjs";
 //#region src/run.ts
 async function main() {
 	await startPlatformServer(definePlatformConfig());

package/dist/{start-Btbz1V6t.cjs → start-BHOssHdU.cjs}

@@ -1710,13 +1710,25 @@ const organizationRoleGrants = {
 	admin: [organizationActions.update],
 	builder: []
 };
-const userActions = { manage: "users:manage" };
-const userGrants = [userActions.manage];
+const userActions = {
+	manage: "users:manage",
+	invite: "users:invite"
+};
+const userGrants = [userActions.manage, userActions.invite];
 const userRoleGrants = {
-	owner: [userActions.manage],
-	admin: [userActions.manage],
-	builder: []
+	owner: [userActions.manage, userActions.invite],
+	admin: [userActions.manage, userActions.invite],
+	builder: [userActions.invite]
+};
+/** Role ceiling: which roles each inviter may grant. Owner is never invitable (shared schema). */
+const invitableRolesByRole = {
+	owner: ["admin", "builder"],
+	admin: ["admin", "builder"],
+	builder: ["builder"]
 };
+function canInviteRole(inviter, invited) {
+	return invitableRolesByRole[inviter].includes(invited);
+}
 [...organizationGrants, ...userGrants];
 function mergeRoleGrants(role) {
 	return [...organizationRoleGrants[role], ...userRoleGrants[role]];
@@ -1739,12 +1751,11 @@ function authorize(action) {
 	};
 }
 //#endregion
-//#region src/auth/require-org-admin.ts
-const adminRoles = new Set(["owner", "admin"]);
-function requireOrgAdmin() {
+//#region src/auth/authorize-payload.ts
+function authorizePayload(schema, allow) {
 	return async (c, next) => {
-		const { role } = c.get("organization");
-		if (!adminRoles.has(role)) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Forbidden" }), 403);
+		const parsed = schema.safeParse(await c.req.json().catch(() => null));
+		if (parsed.success && !allow({ orgRole: c.get("organization").role }, parsed.data)) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Forbidden" }), 403);
 		await next();
 	};
 }
@@ -2946,8 +2957,10 @@ function mountAccountRoutes(options) {
 	orgScoped.use("/*", requireOrganization());
 	projectScoped.use("/*", protect);
 	projectScoped.use("/*", requireOrganization());
-	const orgAdmin = requireOrgAdmin();
 	const requireOrgUpdate = authorize(organizationActions.update);
+	const requireUserManage = authorize(userActions.manage);
+	const requireUserInvite = authorize(userActions.invite);
+	const requireInvitableRole = authorizePayload(require_dist.InviteOrganizationMembersRequestSchema, (ctx, body) => canInviteRole(ctx.orgRole, body.role));
 	const requireOrgParam = requireOrganizationParam();
 	account.get("/organizations", handler$37);
 	account.get("/organizations/slug-available", handler$36);
@@ -2966,9 +2979,9 @@ function mountAccountRoutes(options) {
 	account.get("/users/me/preferences", handler$39);
 	account.patch("/users/me/preferences", handler$38);
 	orgScoped.get("/members", handler$6);
-	orgScoped.post("/members/invitations", orgAdmin, handler$5);
-	orgScoped.patch("/members/:userId", orgAdmin, handler$4);
-	orgScoped.delete("/members/:userId", orgAdmin, handler$3);
+	orgScoped.post("/members/invitations", requireUserInvite, requireInvitableRole, handler$5);
+	orgScoped.patch("/members/:userId", requireUserManage, handler$4);
+	orgScoped.delete("/members/:userId", requireUserManage, handler$3);
 	const withOrgDb = withOrganizationProjectDatabase();
 	orgScoped.get("/agents", withOrgDb, handler$27);
 	orgScoped.get("/agents/:agentId", withOrgDb, handler$26);
@@ -3967,4 +3980,4 @@ Object.defineProperty(exports, "startPlatformServer", {
 	}
 });
 
-//# sourceMappingURL=start-Btbz1V6t.cjs.map
+//# sourceMappingURL=start-BHOssHdU.cjs.map