@makolabs/ripple 3.0.11 → 3.1.0

package/dist/funcs/mock-user-management.d.ts

@@ -109,6 +109,7 @@ export declare function getPendingUsers(options: GetUsersOptions): Promise<GetUs
 export declare function approveUser(input: {
     userId: string;
     role: string;
+    permissions?: string[];
 }): Promise<{
     apiKey: string;
 }>;

package/dist/funcs/user-management.remote.d.ts

@@ -21,6 +21,29 @@ export declare const generateApiKey: import("@sveltejs/kit").RemoteCommand<{
     apiKey: string;
     message: string;
 }>>;
+/**
+ * List users who exist in the identity provider but are NOT yet members of
+ * ALLOWED_ORG_ID. Treats org membership as the "approved" signal — anyone
+ * authenticated against the app without org membership is "pending".
+ */
+export declare const getPendingUsers: import("@sveltejs/kit").RemoteCommand<GetUsersOptions, Promise<GetUsersResult>>;
+/**
+ * Approve a pending user: add them to ALLOWED_ORG_ID with the chosen Clerk role,
+ * then mint an API key carrying the supplied scope set. The caller (the modal)
+ * resolves the role's scopes from the `roles` prop and passes them in.
+ */
+export declare const approveUser: import("@sveltejs/kit").RemoteCommand<{
+    userId: string;
+    role: string;
+    permissions: string[];
+}, Promise<{
+    apiKey: string;
+}>>;
+/**
+ * Reject a pending user — permanently deletes them from the identity provider.
+ * Destructive and irreversible; the user loses login, history, everything.
+ */
+export declare const rejectUser: import("@sveltejs/kit").RemoteCommand<string, Promise<void>>;
 export declare const verifyToken: import("@sveltejs/kit").RemoteCommand<{
     apiKey: string;
 }, Promise<{

package/dist/funcs/user-management.remote.js

@@ -772,6 +772,134 @@ export const generateApiKey = command('unchecked', async (options) => {
         throw new Error(`Failed to generate API key: ${error instanceof Error ? error.message : 'Unknown error'}`);
     }
 });
+/**
+ * Fetch the set of Clerk user IDs that already belong to ALLOWED_ORG_ID.
+ * Pages through Clerk's memberships endpoint until exhausted.
+ */
+async function fetchOrgMemberIds() {
+    if (!ORGANIZATION_ID) {
+        throw new Error('ALLOWED_ORG_ID environment variable is required');
+    }
+    const memberIds = new Set();
+    const limit = 500;
+    let offset = 0;
+    while (true) {
+        const data = await makeClerkRequest(`/organizations/${ORGANIZATION_ID}/memberships?limit=${limit}&offset=${offset}`);
+        const list = Array.isArray(data)
+            ? data
+            : (data?.data ?? []);
+        for (const m of list) {
+            const uid = m?.public_user_data?.user_id;
+            if (uid)
+                memberIds.add(uid);
+        }
+        if (list.length < limit)
+            break;
+        offset += limit;
+    }
+    return memberIds;
+}
+/**
+ * List users who exist in the identity provider but are NOT yet members of
+ * ALLOWED_ORG_ID. Treats org membership as the "approved" signal — anyone
+ * authenticated against the app without org membership is "pending".
+ */
+export const getPendingUsers = command('unchecked', async (options) => {
+    log.trace('getPendingUsers', 'Called with options:', options);
+    try {
+        const memberIds = await fetchOrgMemberIds();
+        // Pull all users (paginated) — Clerk has no "not in org" filter, so
+        // we filter client-side. For typical org sizes this is one or two API calls.
+        const all = [];
+        const limit = 500;
+        let offset = 0;
+        while (true) {
+            const params = new URLSearchParams({
+                limit: limit.toString(),
+                offset: offset.toString(),
+                order_by: '-created_at'
+            });
+            if (options.query)
+                params.append('query', options.query);
+            const page = await makeClerkRequest(`/users?${params}`);
+            const users = Array.isArray(page) ? page : (page?.data ?? []);
+            all.push(...users);
+            if (users.length < limit)
+                break;
+            offset += limit;
+        }
+        const pending = all.filter((u) => !memberIds.has(u.id));
+        const start = (options.page - 1) * options.pageSize;
+        const slice = pending.slice(start, start + options.pageSize);
+        log.trace('getPendingUsers', 'Total users:', all.length, 'org members:', memberIds.size, 'pending:', pending.length);
+        return JSON.parse(JSON.stringify({
+            users: slice,
+            totalUsers: pending.length
+        }));
+    }
+    catch (error) {
+        log.error('getPendingUsers', 'Error:', error);
+        throw new Error(`Failed to fetch pending users: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+});
+/**
+ * Approve a pending user: add them to ALLOWED_ORG_ID with the chosen Clerk role,
+ * then mint an API key carrying the supplied scope set. The caller (the modal)
+ * resolves the role's scopes from the `roles` prop and passes them in.
+ */
+export const approveUser = command('unchecked', async (input) => {
+    log.trace('approveUser', 'Called for userId:', input.userId, 'role:', input.role, 'permissions:', input.permissions);
+    if (!input.role?.trim()) {
+        throw new Error('Role is required to approve a user');
+    }
+    if (!input.permissions?.length) {
+        throw new Error('At least one permission scope is required to approve a user');
+    }
+    try {
+        const clerkRole = input.role.startsWith('org:') ? input.role : `org:${input.role}`;
+        await makeClerkRequest(`/organizations/${ORGANIZATION_ID}/memberships`, {
+            method: 'POST',
+            body: JSON.stringify({ user_id: input.userId, role: clerkRole })
+        });
+        const user = await makeClerkRequest(`/users/${input.userId}`);
+        const email = user.email_addresses?.[0]?.email_address;
+        if (!email) {
+            throw new Error('User has no email address');
+        }
+        const adminKeyResult = await createUserPermissions(email, input.permissions);
+        const apiKey = adminKeyResult?.data?.key;
+        if (!apiKey) {
+            throw new Error('Failed to mint API key during approval');
+        }
+        await makeClerkRequest(`/users/${input.userId}`, {
+            method: 'PATCH',
+            body: JSON.stringify({
+                private_metadata: { ...(user.private_metadata || {}), mako_api_key: apiKey }
+            })
+        });
+        log.trace('approveUser', 'Approved and key issued');
+        return JSON.parse(JSON.stringify({ apiKey }));
+    }
+    catch (error) {
+        log.error('approveUser', 'Error:', error);
+        handleClerkError(error, 'Failed to approve user');
+    }
+});
+/**
+ * Reject a pending user — permanently deletes them from the identity provider.
+ * Destructive and irreversible; the user loses login, history, everything.
+ */
+export const rejectUser = command('unchecked', async (userId) => {
+    log.trace('rejectUser', 'Called for userId:', userId);
+    try {
+        await makeClerkRequest(`/users/${userId}`, { method: 'DELETE' });
+        log.trace('rejectUser', 'Deleted successfully');
+    }
+    catch (error) {
+        log.error('rejectUser', 'Error:', error);
+        throw new Error(`Failed to reject user: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+});
 export const verifyToken = command('unchecked', async (options) => {
     log.trace('verifyToken', 'Called');
     try {

package/dist/user-management/UserApproveModal.svelte

@@ -32,7 +32,12 @@
 		if (!user || !selectedRole) return;
 		approving = true;
 		try {
-			const result = await onapprove({ userId: user.id, role: selectedRole });
+			const permissions = roles.find((r) => r.value === selectedRole)?.permissions ?? [];
+			const result = await onapprove({
+				userId: user.id,
+				role: selectedRole,
+				permissions: [...permissions]
+			});
 			issuedKey = result.apiKey;
 		} catch (error) {
 			toast.error(error instanceof Error ? error.message : 'Failed to approve user');

package/dist/user-management/UserManagement.svelte

@@ -320,11 +320,19 @@
 		showApproveModal = true;
 	}
 
-	async function handleApproveUser({ userId, role }: { userId: string; role: string }) {
+	async function handleApproveUser({
+		userId,
+		role,
+		permissions
+	}: {
+		userId: string;
+		role: string;
+		permissions: string[];
+	}) {
 		if (!adapter.approveUser) {
 			throw new Error('approveUser is not configured on the adapter');
 		}
-		const result = await adapter.approveUser({ userId, role });
+		const result = await adapter.approveUser({ userId, role, permissions });
 		// The user is approved AND we hold their one-time API key. A refresh failure
 		// here must NOT lose that key — surface a soft warning instead of throwing.
 		try {

package/dist/user-management/user-management-types.d.ts

@@ -214,12 +214,15 @@ export interface UserManagementAdapter {
     getPendingUsers?: (options: GetUsersOptions) => PromiseLike<GetUsersResult>;
     /**
      * Optional. Approve a pending user — assigns them to the org with the
-     * selected role and generates their first API key. Returns the new key
-     * for one-time reveal in the UI.
+     * selected role and generates their first API key with the given scopes.
+     * Returns the new key for one-time reveal in the UI. The `permissions`
+     * array is the resolved scope list for the chosen role; the modal looks
+     * it up from the `roles` prop so adapters don't need a role→scope map.
      */
     approveUser?: (input: {
         userId: string;
         role: string;
+        permissions: string[];
     }) => PromiseLike<{
         apiKey: string;
     }>;
@@ -238,12 +241,14 @@ export interface UserApproveModalProps {
     user: User | null;
     roles?: Role[];
     /**
-     * Approval callback. Receives the userId and chosen role; should resolve
+     * Approval callback. Receives the userId, chosen role, and the resolved
+     * scope list for that role (looked up from the `roles` prop). Resolves
      * with the newly generated API key for one-time display.
      */
     onapprove: (input: {
         userId: string;
         role: string;
+        permissions: string[];
     }) => Promise<{
         apiKey: string;
     }>;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@makolabs/ripple",
-	"version": "3.0.11",
+	"version": "3.1.0",
 	"description": "Simple Svelte 5 powered component library ✨",
 	"license": "SEE LICENSE IN LICENSE",
 	"repository": {