@mesob/auth-hono 0.2.5 → 0.3.1

package/dist/index.js

@@ -44,36 +44,36 @@ __export(schema_exports, {
   usersInIam: () => usersInIam,
   verificationsInIam: () => verificationsInIam
 });
-import { pgSchema, uniqueIndex, foreignKey, unique, pgPolicy, check, uuid, varchar, timestamp, text, boolean, smallint, index, inet, jsonb } from "drizzle-orm/pg-core";
+import { pgSchema, index, foreignKey, pgPolicy, check, uuid, varchar, timestamp, text, smallint, unique, inet, jsonb, boolean, uniqueIndex } from "drizzle-orm/pg-core";
 import { sql } from "drizzle-orm";
 var iam = pgSchema("iam");
-var usersInIam = iam.table("users", {
+var verificationsInIam = iam.table("verifications", {
   id: uuid().default(sql`uuid_generate_v7()`).primaryKey().notNull(),
   tenantId: varchar("tenant_id", { length: 30 }).notNull(),
   createdAt: timestamp("created_at", { withTimezone: true, mode: "string" }).default(sql`CURRENT_TIMESTAMP`).notNull(),
   updatedAt: timestamp("updated_at", { withTimezone: true, mode: "string" }).default(sql`CURRENT_TIMESTAMP`).notNull(),
-  fullName: text("full_name").notNull(),
-  image: text(),
-  phone: text(),
-  email: text(),
-  handle: text().notNull(),
-  emailVerified: boolean("email_verified").default(false).notNull(),
-  phoneVerified: boolean("phone_verified").default(false).notNull(),
-  bannedUntil: timestamp("banned_until", { withTimezone: true, mode: "string" }),
-  lastSignInAt: timestamp("last_sign_in_at", { withTimezone: true, mode: "string" }),
-  loginAttempt: smallint("login_attempt").default(0).notNull()
+  userId: uuid("user_id").notNull(),
+  code: text().notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true, mode: "string" }).notNull(),
+  type: text(),
+  attempt: smallint().default(0),
+  to: text()
 }, (table) => [
-  uniqueIndex("users_tenant_lower_email_idx").using("btree", sql`tenant_id`, sql`lower(email)`),
-  uniqueIndex("users_tenant_lower_handle_idx").using("btree", sql`tenant_id`, sql`lower(handle)`),
+  index("verifications_expires_at_idx").using("btree", table.expiresAt.asc().nullsLast().op("timestamptz_ops")),
+  index("verifications_lookup_idx").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.userId.asc().nullsLast().op("text_ops"), table.type.asc().nullsLast().op("uuid_ops"), table.to.asc().nullsLast().op("text_ops"), table.code.asc().nullsLast().op("text_ops")),
   foreignKey({
     columns: [table.tenantId],
     foreignColumns: [tenantsInIam.id],
-    name: "users_tenant_id_fkey"
+    name: "verifications_tenant_id_fkey"
+  }).onUpdate("cascade").onDelete("cascade"),
+  foreignKey({
+    columns: [table.userId],
+    foreignColumns: [usersInIam.id],
+    name: "verifications_user_id_fkey"
   }).onUpdate("cascade").onDelete("cascade"),
-  unique("users_tenant_phone_key").on(table.tenantId, table.phone),
   pgPolicy("tenant_isolation", { as: "permissive", for: "all", to: ["public"], using: sql`((tenant_id)::text = (iam.current_tenant_id())::text)`, withCheck: sql`((tenant_id)::text = (iam.current_tenant_id())::text)` }),
-  check("users_contact_required_check", sql`(email IS NOT NULL) OR (phone IS NOT NULL)`),
-  check("users_login_attempt_nonnegative_check", sql`login_attempt >= 0`)
+  check("verifications_attempt_nonnegative_check", sql`attempt >= 0`),
+  check("verifications_expires_after_created_check", sql`expires_at > created_at`)
 ]);
 var sessionsInIam = iam.table("sessions", {
   id: uuid().default(sql`uuid_generate_v7()`).primaryKey().notNull(),
@@ -89,7 +89,7 @@ var sessionsInIam = iam.table("sessions", {
   rotatedAt: timestamp("rotated_at", { withTimezone: true, mode: "string" }).default(sql`CURRENT_TIMESTAMP`)
 }, (table) => [
   index("sessions_expires_at_idx").using("btree", table.expiresAt.asc().nullsLast().op("timestamptz_ops")),
-  index("sessions_tenant_user_idx").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.userId.asc().nullsLast().op("uuid_ops")),
+  index("sessions_tenant_user_idx").using("btree", table.tenantId.asc().nullsLast().op("uuid_ops"), table.userId.asc().nullsLast().op("text_ops")),
   foreignKey({
     columns: [table.tenantId],
     foreignColumns: [tenantsInIam.id],
@@ -104,34 +104,6 @@ var sessionsInIam = iam.table("sessions", {
   pgPolicy("tenant_isolation", { as: "permissive", for: "all", to: ["public"], using: sql`((tenant_id)::text = (iam.current_tenant_id())::text)`, withCheck: sql`((tenant_id)::text = (iam.current_tenant_id())::text)` }),
   check("sessions_expires_after_created_check", sql`expires_at > created_at`)
 ]);
-var verificationsInIam = iam.table("verifications", {
-  id: uuid().default(sql`uuid_generate_v7()`).primaryKey().notNull(),
-  tenantId: varchar("tenant_id", { length: 30 }).notNull(),
-  createdAt: timestamp("created_at", { withTimezone: true, mode: "string" }).default(sql`CURRENT_TIMESTAMP`).notNull(),
-  updatedAt: timestamp("updated_at", { withTimezone: true, mode: "string" }).default(sql`CURRENT_TIMESTAMP`).notNull(),
-  userId: uuid("user_id").notNull(),
-  code: text().notNull(),
-  expiresAt: timestamp("expires_at", { withTimezone: true, mode: "string" }).notNull(),
-  type: text(),
-  attempt: smallint().default(0),
-  to: text()
-}, (table) => [
-  index("verifications_expires_at_idx").using("btree", table.expiresAt.asc().nullsLast().op("timestamptz_ops")),
-  index("verifications_lookup_idx").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.userId.asc().nullsLast().op("text_ops"), table.type.asc().nullsLast().op("uuid_ops"), table.to.asc().nullsLast().op("text_ops"), table.code.asc().nullsLast().op("text_ops")),
-  foreignKey({
-    columns: [table.tenantId],
-    foreignColumns: [tenantsInIam.id],
-    name: "verifications_tenant_id_fkey"
-  }).onUpdate("cascade").onDelete("cascade"),
-  foreignKey({
-    columns: [table.userId],
-    foreignColumns: [usersInIam.id],
-    name: "verifications_user_id_fkey"
-  }).onUpdate("cascade").onDelete("cascade"),
-  pgPolicy("tenant_isolation", { as: "permissive", for: "all", to: ["public"], using: sql`((tenant_id)::text = (iam.current_tenant_id())::text)`, withCheck: sql`((tenant_id)::text = (iam.current_tenant_id())::text)` }),
-  check("verifications_attempt_nonnegative_check", sql`attempt >= 0`),
-  check("verifications_expires_after_created_check", sql`expires_at > created_at`)
-]);
 var accountChangesInIam = iam.table("account_changes", {
   id: uuid().default(sql`uuid_generate_v7()`).primaryKey().notNull(),
   tenantId: varchar("tenant_id", { length: 30 }).notNull(),
@@ -150,7 +122,8 @@ var accountChangesInIam = iam.table("account_changes", {
   reason: text()
 }, (table) => [
   index("account_changes_expires_at_idx").using("btree", table.expiresAt.asc().nullsLast().op("timestamptz_ops")),
-  index("account_changes_tenant_user_status_idx").using("btree", table.tenantId.asc().nullsLast().op("uuid_ops"), table.userId.asc().nullsLast().op("text_ops"), table.status.asc().nullsLast().op("text_ops")),
+  index("account_changes_tenant_user_status_idx").using("btree", table.tenantId.asc().nullsLast().op("uuid_ops"), table.userId.asc().nullsLast().op("text_ops"), table.status.asc().nullsLast().op("uuid_ops")),
+  index("idx_account_changes_expired").using("btree", table.expiresAt.asc().nullsLast().op("text_ops"), table.status.asc().nullsLast().op("text_ops")).where(sql`((status)::text = 'pending'::text)`),
   foreignKey({
     columns: [table.tenantId],
     foreignColumns: [tenantsInIam.id],
@@ -162,9 +135,9 @@ var accountChangesInIam = iam.table("account_changes", {
     name: "account_changes_user_id_fkey"
   }).onUpdate("cascade").onDelete("cascade"),
   pgPolicy("tenant_isolation", { as: "permissive", for: "all", to: ["public"], using: sql`((tenant_id)::text = (iam.current_tenant_id())::text)`, withCheck: sql`((tenant_id)::text = (iam.current_tenant_id())::text)` }),
-  check("account_changes_change_type_check", sql`((change_type = 'email'::text) AND (old_email IS NOT NULL) AND (new_email IS NOT NULL) AND (old_phone IS NULL) AND (new_phone IS NULL)) OR ((change_type = 'phone'::text) AND (old_phone IS NOT NULL) AND (new_phone IS NOT NULL) AND (old_email IS NULL) AND (new_email IS NULL))`),
   check("account_changes_expires_after_created_check", sql`expires_at > created_at`),
-  check("account_changes_status_check", sql`(status)::text = ANY ((ARRAY['pending'::character varying, 'applied'::character varying, 'cancelled'::character varying, 'expired'::character varying])::text[])`)
+  check("account_changes_change_type_check", sql`((change_type = 'EMAIL'::text) AND (old_email IS NOT NULL) AND (new_email IS NOT NULL) AND (old_phone IS NULL) AND (new_phone IS NULL)) OR ((change_type = 'PHONE'::text) AND (old_phone IS NOT NULL) AND (new_phone IS NOT NULL) AND (old_email IS NULL) AND (new_email IS NULL))`),
+  check("account_changes_status_check", sql`(status)::text = ANY (ARRAY[('PENDING'::character varying)::text, ('APPLIED'::character varying)::text, ('CANCELLED'::character varying)::text, ('EXPIRED'::character varying)::text])`)
 ]);
 var tenantsInIam = iam.table("tenants", {
   id: varchar({ length: 30 }).primaryKey().notNull(),
@@ -185,21 +158,30 @@ var tenantsInIam = iam.table("tenants", {
 }, (table) => [
   index("tenants_is_active_idx").using("btree", table.isActive.asc().nullsLast().op("bool_ops"))
 ]);
-var rolesInIam = iam.table("roles", {
+var rolePermissionsInIam = iam.table("role_permissions", {
   id: uuid().default(sql`uuid_generate_v7()`).primaryKey().notNull(),
   tenantId: varchar("tenant_id", { length: 30 }).notNull(),
-  createdAt: timestamp("created_at", { withTimezone: true, mode: "string" }).default(sql`CURRENT_TIMESTAMP`).notNull(),
-  updatedAt: timestamp("updated_at", { withTimezone: true, mode: "string" }).default(sql`CURRENT_TIMESTAMP`).notNull(),
-  name: jsonb().notNull(),
-  description: jsonb().notNull(),
-  code: text().notNull()
+  roleId: text("role_id").notNull(),
+  permissionId: text("permission_id").notNull()
 }, (table) => [
+  index("idx_role_permissions_permission_id").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.permissionId.asc().nullsLast().op("text_ops")),
+  index("idx_role_permissions_tenant_role").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.roleId.asc().nullsLast().op("text_ops")),
   foreignKey({
     columns: [table.tenantId],
     foreignColumns: [tenantsInIam.id],
-    name: "roles_tenant_id_fkey"
+    name: "role_permissions_tenant_id_fkey"
   }).onUpdate("cascade").onDelete("cascade"),
-  unique("roles_tenant_code_unique").on(table.tenantId, table.code),
+  foreignKey({
+    columns: [table.permissionId],
+    foreignColumns: [permissionsInIam.id],
+    name: "role_permissions_permission_id_fkey"
+  }).onUpdate("cascade").onDelete("cascade"),
+  foreignKey({
+    columns: [table.roleId],
+    foreignColumns: [rolesInIam.id],
+    name: "role_permissions_role_id_fkey"
+  }).onUpdate("cascade").onDelete("cascade"),
+  unique("role_permissions_unique").on(table.roleId, table.permissionId),
   pgPolicy("tenant_isolation", { as: "permissive", for: "all", to: ["public"], using: sql`((tenant_id)::text = (iam.current_tenant_id())::text)`, withCheck: sql`((tenant_id)::text = (iam.current_tenant_id())::text)` })
 ]);
 var permissionsInIam = iam.table("permissions", {
@@ -211,82 +193,118 @@ var permissionsInIam = iam.table("permissions", {
 }, (table) => [
   unique("permissions_activity_application_feature_key").on(table.activity, table.application, table.feature)
 ]);
-var rolePermissionsInIam = iam.table("role_permissions", {
+var accountsInIam = iam.table("accounts", {
   id: uuid().default(sql`uuid_generate_v7()`).primaryKey().notNull(),
   tenantId: varchar("tenant_id", { length: 30 }).notNull(),
-  roleId: uuid("role_id").notNull(),
-  permissionId: text("permission_id").notNull()
+  userId: uuid("user_id").notNull(),
+  provider: text().notNull(),
+  providerAccountId: text("provider_account_id").notNull(),
+  password: text(),
+  passwordLastChangedAt: timestamp("password_last_changed_at", { withTimezone: true, mode: "string" }),
+  idToken: text("id_token"),
+  accessToken: text("access_token"),
+  accessTokenExpiresAt: timestamp("access_token_expires_at", { withTimezone: true, mode: "string" }),
+  refreshToken: text("refresh_token"),
+  refreshTokenExpiresAt: timestamp("refresh_token_expires_at", { withTimezone: true, mode: "string" }),
+  scope: text(),
+  expiresAt: timestamp("expires_at", { withTimezone: true, mode: "string" }),
+  meta: jsonb()
 }, (table) => [
+  index("idx_accounts_provider_lookup").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.provider.asc().nullsLast().op("text_ops"), table.providerAccountId.asc().nullsLast().op("text_ops")),
+  index("idx_accounts_user_id").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.userId.asc().nullsLast().op("text_ops")),
   foreignKey({
-    columns: [table.permissionId],
-    foreignColumns: [permissionsInIam.id],
-    name: "role_permissions_permission_id_fkey"
+    columns: [table.tenantId],
+    foreignColumns: [tenantsInIam.id],
+    name: "accounts_tenant_id_fkey"
   }).onUpdate("cascade").onDelete("cascade"),
   foreignKey({
-    columns: [table.roleId],
-    foreignColumns: [rolesInIam.id],
-    name: "role_permissions_role_id_fkey"
+    columns: [table.userId],
+    foreignColumns: [usersInIam.id],
+    name: "accounts_user_id_fkey"
   }).onUpdate("cascade").onDelete("cascade"),
+  unique("accounts_tenant_provider_account_unique").on(table.tenantId, table.provider, table.providerAccountId),
+  pgPolicy("tenant_isolation", { as: "permissive", for: "all", to: ["public"], using: sql`((tenant_id)::text = (iam.current_tenant_id())::text)`, withCheck: sql`((tenant_id)::text = (iam.current_tenant_id())::text)` })
+]);
+var rolesInIam = iam.table("roles", {
+  id: text().primaryKey().notNull(),
+  tenantId: varchar("tenant_id", { length: 30 }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true, mode: "string" }).default(sql`CURRENT_TIMESTAMP`).notNull(),
+  updatedAt: timestamp("updated_at", { withTimezone: true, mode: "string" }).default(sql`CURRENT_TIMESTAMP`).notNull(),
+  name: jsonb().notNull(),
+  description: jsonb().notNull(),
+  code: text().notNull()
+}, (table) => [
   foreignKey({
     columns: [table.tenantId],
     foreignColumns: [tenantsInIam.id],
-    name: "role_permissions_tenant_id_fkey"
+    name: "roles_tenant_id_fkey"
   }).onUpdate("cascade").onDelete("cascade"),
-  unique("role_permissions_unique").on(table.roleId, table.permissionId),
+  unique("roles_tenant_code_unique").on(table.tenantId, table.code),
   pgPolicy("tenant_isolation", { as: "permissive", for: "all", to: ["public"], using: sql`((tenant_id)::text = (iam.current_tenant_id())::text)`, withCheck: sql`((tenant_id)::text = (iam.current_tenant_id())::text)` })
 ]);
-var userRolesInIam = iam.table("user_roles", {
+var usersInIam = iam.table("users", {
   id: uuid().default(sql`uuid_generate_v7()`).primaryKey().notNull(),
   tenantId: varchar("tenant_id", { length: 30 }).notNull(),
-  userId: uuid("user_id").notNull(),
-  roleId: uuid("role_id").notNull()
+  createdAt: timestamp("created_at", { withTimezone: true, mode: "string" }).default(sql`CURRENT_TIMESTAMP`).notNull(),
+  updatedAt: timestamp("updated_at", { withTimezone: true, mode: "string" }).default(sql`CURRENT_TIMESTAMP`).notNull(),
+  fullName: text("full_name").notNull(),
+  image: text(),
+  phone: text(),
+  email: text(),
+  handle: text().notNull(),
+  emailVerified: boolean("email_verified").default(false).notNull(),
+  phoneVerified: boolean("phone_verified").default(false).notNull(),
+  bannedUntil: timestamp("banned_until", { withTimezone: true, mode: "string" }),
+  lastSignInAt: timestamp("last_sign_in_at", { withTimezone: true, mode: "string" }),
+  loginAttempt: smallint("login_attempt").default(0).notNull(),
+  userType: text("user_type").array().default(["employee"]).notNull()
 }, (table) => [
-  foreignKey({
-    columns: [table.roleId],
-    foreignColumns: [rolesInIam.id],
-    name: "user_roles_role_id_fkey"
-  }).onUpdate("cascade").onDelete("cascade"),
+  index("idx_users_auth_lookup").using("btree", table.tenantId.asc().nullsLast().op("bool_ops"), table.email.asc().nullsLast().op("bool_ops"), table.id.asc().nullsLast().op("timestamptz_ops"), table.emailVerified.asc().nullsLast().op("timestamptz_ops"), table.bannedUntil.asc().nullsLast().op("uuid_ops")).where(sql`(email IS NOT NULL)`),
+  index("idx_users_email_lookup").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.email.asc().nullsLast().op("text_ops")).where(sql`(email IS NOT NULL)`),
+  index("idx_users_handle_lookup").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.handle.asc().nullsLast().op("text_ops")),
+  index("idx_users_phone_lookup").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.phone.asc().nullsLast().op("text_ops")).where(sql`(phone IS NOT NULL)`),
+  index("idx_users_tenant_email_unique").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.email.asc().nullsLast().op("text_ops")).where(sql`(email IS NOT NULL)`),
+  index("idx_users_tenant_is_admin").using("btree", table.tenantId.asc().nullsLast().op("text_ops")).where(sql`(user_type @> ARRAY['admin'::text])`),
+  index("idx_users_tenant_is_candidate").using("btree", table.tenantId.asc().nullsLast().op("text_ops")).where(sql`(user_type @> ARRAY['candidate'::text])`),
+  index("idx_users_tenant_is_employee").using("btree", table.tenantId.asc().nullsLast().op("text_ops")).where(sql`(user_type @> ARRAY['employee'::text])`),
+  index("idx_users_user_types_gin").using("gin", table.userType.asc().nullsLast().op("array_ops")),
+  uniqueIndex("users_tenant_lower_email_idx").using("btree", sql`tenant_id`, sql`lower(email)`),
+  uniqueIndex("users_tenant_lower_handle_idx").using("btree", sql`tenant_id`, sql`lower(handle)`),
   foreignKey({
     columns: [table.tenantId],
     foreignColumns: [tenantsInIam.id],
-    name: "user_roles_tenant_id_fkey"
-  }).onUpdate("cascade").onDelete("cascade"),
-  foreignKey({
-    columns: [table.userId],
-    foreignColumns: [usersInIam.id],
-    name: "user_roles_user_id_fkey"
+    name: "users_tenant_id_fkey"
   }).onUpdate("cascade").onDelete("cascade"),
-  unique("user_roles_unique").on(table.userId, table.roleId),
-  pgPolicy("tenant_isolation", { as: "permissive", for: "all", to: ["public"], using: sql`((tenant_id)::text = (iam.current_tenant_id())::text)`, withCheck: sql`((tenant_id)::text = (iam.current_tenant_id())::text)` })
+  unique("users_tenant_phone_key").on(table.tenantId, table.phone),
+  pgPolicy("tenant_isolation", { as: "permissive", for: "all", to: ["public"], using: sql`((tenant_id)::text = (iam.current_tenant_id())::text)`, withCheck: sql`((tenant_id)::text = (iam.current_tenant_id())::text)` }),
+  check("users_login_attempt_nonnegative_check", sql`login_attempt >= 0`),
+  check("users_contact_required_check", sql`(email IS NOT NULL) OR (phone IS NOT NULL)`),
+  check("users_user_type_check", sql`user_type <@ ARRAY['candidate'::text, 'employee'::text, 'admin'::text]`)
 ]);
-var accountsInIam = iam.table("accounts", {
+var userRolesInIam = iam.table("user_roles", {
   id: uuid().default(sql`uuid_generate_v7()`).primaryKey().notNull(),
   tenantId: varchar("tenant_id", { length: 30 }).notNull(),
   userId: uuid("user_id").notNull(),
-  provider: text().notNull(),
-  providerAccountId: text("provider_account_id").notNull(),
-  password: text(),
-  passwordLastChangedAt: timestamp("password_last_changed_at", { withTimezone: true, mode: "string" }),
-  idToken: text("id_token"),
-  accessToken: text("access_token"),
-  accessTokenExpiresAt: timestamp("access_token_expires_at", { withTimezone: true, mode: "string" }),
-  refreshToken: text("refresh_token"),
-  refreshTokenExpiresAt: timestamp("refresh_token_expires_at", { withTimezone: true, mode: "string" }),
-  scope: text(),
-  expiresAt: timestamp("expires_at", { withTimezone: true, mode: "string" }),
-  meta: jsonb()
+  roleId: text("role_id").notNull()
 }, (table) => [
+  index("idx_user_roles_role_id").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.roleId.asc().nullsLast().op("text_ops")),
+  index("idx_user_roles_tenant_user").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.userId.asc().nullsLast().op("text_ops")),
   foreignKey({
     columns: [table.tenantId],
     foreignColumns: [tenantsInIam.id],
-    name: "accounts_tenant_id_fkey"
+    name: "user_roles_tenant_id_fkey"
   }).onUpdate("cascade").onDelete("cascade"),
   foreignKey({
     columns: [table.userId],
     foreignColumns: [usersInIam.id],
-    name: "accounts_user_id_fkey"
+    name: "user_roles_user_id_fkey"
   }).onUpdate("cascade").onDelete("cascade"),
-  unique("accounts_tenant_provider_account_unique").on(table.tenantId, table.provider, table.providerAccountId),
+  foreignKey({
+    columns: [table.roleId],
+    foreignColumns: [rolesInIam.id],
+    name: "user_roles_role_id_fkey"
+  }).onUpdate("cascade").onDelete("cascade"),
+  unique("user_roles_unique").on(table.userId, table.roleId),
   pgPolicy("tenant_isolation", { as: "permissive", for: "all", to: ["public"], using: sql`((tenant_id)::text = (iam.current_tenant_id())::text)`, withCheck: sql`((tenant_id)::text = (iam.current_tenant_id())::text)` })
 ]);
 var domainsInIam = iam.table("domains", {
@@ -301,8 +319,8 @@ var domainsInIam = iam.table("domains", {
 }, (table) => [
   uniqueIndex("domains_domain_unique_idx").using("btree", sql`lower(domain)`),
   uniqueIndex("domains_primary_per_tenant_idx").using("btree", table.tenantId.asc().nullsLast().op("text_ops")).where(sql`(is_primary = true)`),
-  index("domains_tenant_id_idx").using("btree", table.tenantId.asc().nullsLast().op("text_ops")),
   index("domains_tenant_status_idx").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.status.asc().nullsLast().op("text_ops")),
+  index("idx_domains_tenant_domain_status").using("btree", table.tenantId.asc().nullsLast().op("text_ops"), table.domain.asc().nullsLast().op("text_ops"), table.status.asc().nullsLast().op("text_ops")),
   foreignKey({
     columns: [table.tenantId],
     foreignColumns: [tenantsInIam.id],
@@ -310,49 +328,49 @@ var domainsInIam = iam.table("domains", {
   }).onUpdate("cascade").onDelete("cascade"),
   pgPolicy("tenant_isolation", { as: "permissive", for: "all", to: ["public"], using: sql`((tenant_id)::text = (iam.current_tenant_id())::text)`, withCheck: sql`((tenant_id)::text = (iam.current_tenant_id())::text)` }),
   check("domains_domain_format_check", sql`domain ~ '^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)+$'::text`),
-  check("domains_status_check", sql`status = ANY (ARRAY['pending'::text, 'active'::text, 'disabled'::text, 'deleted'::text])`)
+  check("domains_status_check", sql`status = ANY (ARRAY['PENDING'::text, 'ACTIVE'::text, 'DISABLED'::text, 'DELETED'::text])`)
 ]);
 
 // src/db/relations.ts
-var usersInIamRelations = relations(usersInIam, ({ one, many }) => ({
+var verificationsInIamRelations = relations(verificationsInIam, ({ one }) => ({
   tenantsInIam: one(tenantsInIam, {
-    fields: [usersInIam.tenantId],
+    fields: [verificationsInIam.tenantId],
     references: [tenantsInIam.id]
   }),
-  sessionsInIam: many(sessionsInIam),
-  verificationsInIam: many(verificationsInIam),
-  accountChangesInIam: many(accountChangesInIam),
-  userRolesInIam: many(userRolesInIam),
-  accountsInIam: many(accountsInIam)
+  usersInIam: one(usersInIam, {
+    fields: [verificationsInIam.userId],
+    references: [usersInIam.id]
+  })
 }));
 var tenantsInIamRelations = relations(tenantsInIam, ({ many }) => ({
-  usersInIam: many(usersInIam),
-  sessionsInIam: many(sessionsInIam),
   verificationsInIam: many(verificationsInIam),
+  sessionsInIam: many(sessionsInIam),
   accountChangesInIam: many(accountChangesInIam),
-  rolesInIam: many(rolesInIam),
   rolePermissionsInIam: many(rolePermissionsInIam),
-  userRolesInIam: many(userRolesInIam),
   accountsInIam: many(accountsInIam),
+  rolesInIam: many(rolesInIam),
+  usersInIam: many(usersInIam),
+  userRolesInIam: many(userRolesInIam),
   domainsInIam: many(domainsInIam)
 }));
-var sessionsInIamRelations = relations(sessionsInIam, ({ one }) => ({
+var usersInIamRelations = relations(usersInIam, ({ one, many }) => ({
+  verificationsInIam: many(verificationsInIam),
+  sessionsInIam: many(sessionsInIam),
+  accountChangesInIam: many(accountChangesInIam),
+  accountsInIam: many(accountsInIam),
   tenantsInIam: one(tenantsInIam, {
-    fields: [sessionsInIam.tenantId],
+    fields: [usersInIam.tenantId],
     references: [tenantsInIam.id]
   }),
-  usersInIam: one(usersInIam, {
-    fields: [sessionsInIam.userId],
-    references: [usersInIam.id]
-  })
+  userRolesInIam: many(userRolesInIam)
 }));
-var verificationsInIamRelations = relations(verificationsInIam, ({ one }) => ({
+var sessionsInIamRelations = relations(sessionsInIam, ({ one }) => ({
   tenantsInIam: one(tenantsInIam, {
-    fields: [verificationsInIam.tenantId],
+    fields: [sessionsInIam.tenantId],
     references: [tenantsInIam.id]
   }),
   usersInIam: one(usersInIam, {
-    fields: [verificationsInIam.userId],
+    fields: [sessionsInIam.userId],
     references: [usersInIam.id]
   })
 }));
@@ -366,15 +384,11 @@ var accountChangesInIamRelations = relations(accountChangesInIam, ({ one }) => (
     references: [usersInIam.id]
   })
 }));
-var rolesInIamRelations = relations(rolesInIam, ({ one, many }) => ({
+var rolePermissionsInIamRelations = relations(rolePermissionsInIam, ({ one }) => ({
   tenantsInIam: one(tenantsInIam, {
-    fields: [rolesInIam.tenantId],
+    fields: [rolePermissionsInIam.tenantId],
     references: [tenantsInIam.id]
   }),
-  rolePermissionsInIam: many(rolePermissionsInIam),
-  userRolesInIam: many(userRolesInIam)
-}));
-var rolePermissionsInIamRelations = relations(rolePermissionsInIam, ({ one }) => ({
   permissionsInIam: one(permissionsInIam, {
     fields: [rolePermissionsInIam.permissionId],
     references: [permissionsInIam.id]
@@ -382,37 +396,41 @@ var rolePermissionsInIamRelations = relations(rolePermissionsInIam, ({ one }) =>
   rolesInIam: one(rolesInIam, {
     fields: [rolePermissionsInIam.roleId],
     references: [rolesInIam.id]
-  }),
-  tenantsInIam: one(tenantsInIam, {
-    fields: [rolePermissionsInIam.tenantId],
-    references: [tenantsInIam.id]
   })
 }));
 var permissionsInIamRelations = relations(permissionsInIam, ({ many }) => ({
   rolePermissionsInIam: many(rolePermissionsInIam)
 }));
-var userRolesInIamRelations = relations(userRolesInIam, ({ one }) => ({
-  rolesInIam: one(rolesInIam, {
-    fields: [userRolesInIam.roleId],
-    references: [rolesInIam.id]
+var rolesInIamRelations = relations(rolesInIam, ({ one, many }) => ({
+  rolePermissionsInIam: many(rolePermissionsInIam),
+  tenantsInIam: one(tenantsInIam, {
+    fields: [rolesInIam.tenantId],
+    references: [tenantsInIam.id]
   }),
+  userRolesInIam: many(userRolesInIam)
+}));
+var accountsInIamRelations = relations(accountsInIam, ({ one }) => ({
   tenantsInIam: one(tenantsInIam, {
-    fields: [userRolesInIam.tenantId],
+    fields: [accountsInIam.tenantId],
     references: [tenantsInIam.id]
   }),
   usersInIam: one(usersInIam, {
-    fields: [userRolesInIam.userId],
+    fields: [accountsInIam.userId],
     references: [usersInIam.id]
   })
 }));
-var accountsInIamRelations = relations(accountsInIam, ({ one }) => ({
+var userRolesInIamRelations = relations(userRolesInIam, ({ one }) => ({
   tenantsInIam: one(tenantsInIam, {
-    fields: [accountsInIam.tenantId],
+    fields: [userRolesInIam.tenantId],
     references: [tenantsInIam.id]
   }),
   usersInIam: one(usersInIam, {
-    fields: [accountsInIam.userId],
+    fields: [userRolesInIam.userId],
     references: [usersInIam.id]
+  }),
+  rolesInIam: one(rolesInIam, {
+    fields: [userRolesInIam.roleId],
+    references: [rolesInIam.id]
   })
 }));
 var domainsInIamRelations = relations(domainsInIam, ({ one }) => ({
@@ -446,8 +464,6 @@ var fetchSessionByToken = async ({
     userId: sessionsInIam.userId,
     expiresAt: sessionsInIam.expiresAt,
     createdAt: sessionsInIam.createdAt,
-    userAgent: sessionsInIam.userAgent,
-    ip: sessionsInIam.ip,
     meta: sessionsInIam.meta
   }).from(sessionsInIam).where(
     and(
@@ -535,20 +551,18 @@ var fetchUserWithRoles = async ({
     emailVerified: usersInIam.emailVerified,
     phoneVerified: usersInIam.phoneVerified,
     lastSignInAt: usersInIam.lastSignInAt,
-    userRoles: sql3`
-        COALESCE(
-          json_agg(
-            json_build_object(
-              'id', ${userRolesInIam.id},
-              'roleId', ${rolesInIam.id},
-              'code', ${rolesInIam.code},
-              'name', ${rolesInIam.name},
-              'description', ${rolesInIam.description}
-            )
-          ) FILTER (WHERE ${userRolesInIam.id} IS NOT NULL),
-          '[]'::json
-        )
-      `
+    roles: sql3`COALESCE(
+        array_to_json(array_agg(DISTINCT ${rolesInIam.id}) FILTER (WHERE ${userRolesInIam.id} IS NOT NULL)),
+        '[]'::json
+      )`,
+    roleCodes: sql3`COALESCE(
+        array_to_json(array_agg(DISTINCT ${rolesInIam.code}) FILTER (WHERE ${rolesInIam.code} IS NOT NULL)),
+        '[]'::json
+      )`,
+    permissions: sql3`COALESCE(
+        array_to_json(array_agg(DISTINCT ${permissionsInIam.id}) FILTER (WHERE ${permissionsInIam.id} IS NOT NULL)),
+        '[]'::json
+      )`
   }).from(usersInIam).leftJoin(
     userRolesInIam,
     and3(
@@ -561,6 +575,15 @@ var fetchUserWithRoles = async ({
       eq3(userRolesInIam.roleId, rolesInIam.id),
       eq3(rolesInIam.tenantId, tenantId)
     )
+  ).leftJoin(
+    rolePermissionsInIam,
+    and3(
+      eq3(rolePermissionsInIam.roleId, rolesInIam.id),
+      eq3(rolePermissionsInIam.tenantId, tenantId)
+    )
+  ).leftJoin(
+    permissionsInIam,
+    eq3(rolePermissionsInIam.permissionId, permissionsInIam.id)
   ).where(and3(eq3(usersInIam.id, userId), eq3(usersInIam.tenantId, tenantId))).groupBy(usersInIam.id).limit(1);
   return userResult || null;
 };
@@ -798,13 +821,6 @@ import { z } from "zod";
 var emailField = z.string().trim().email("Invalid email address").max(255, "Email too long");
 var phoneField = z.string().trim().min(6, "Phone too short").max(30, "Phone too long").regex(/^[+()\d\s-]+$/, "Invalid phone number format");
 var passwordField = z.string().min(8, "Password must be at least 8 characters").max(128, "Password too long");
-var userRoleSchema = z.object({
-  id: z.string().uuid(),
-  roleId: z.string().uuid(),
-  code: z.string(),
-  name: z.string(),
-  description: z.string()
-});
 var userSchema = z.object({
   id: z.string().uuid(),
   tenantId: z.string(),
@@ -816,7 +832,9 @@ var userSchema = z.object({
   emailVerified: z.boolean(),
   phoneVerified: z.boolean(),
   lastSignInAt: z.string().datetime().nullable(),
-  userRoles: z.array(userRoleSchema).nullable()
+  roles: z.array(z.string()).nullable().optional(),
+  roleCodes: z.array(z.string()).nullable().optional(),
+  permissions: z.array(z.string()).nullable().optional()
 });
 var sessionSchema = z.object({
   id: z.string().uuid(),
@@ -962,11 +980,14 @@ var checkAccountHandler = async (c) => {
   const resolvedTenantId = ensureTenantId(config, tenantId);
   const { username } = body;
   const isEmail = username.includes("@");
+  const userTypeFilter = sql4`${usersInIam.userType} @> ARRAY[${config.userType}]::text[]`;
   const whereClause = isEmail ? and4(
     eq4(usersInIam.tenantId, resolvedTenantId),
+    userTypeFilter,
     sql4`lower(${usersInIam.email}) = lower(${username})`
   ) : and4(
     eq4(usersInIam.tenantId, resolvedTenantId),
+    userTypeFilter,
     eq4(usersInIam.phone, username)
   );
   const [result] = await database.select({
@@ -982,6 +1003,7 @@ var checkAccountHandler = async (c) => {
 };
 
 // src/routes/auth/handler/sign-in.ts
+import { logger as logger2 } from "@mesob/common";
 import { and as and8, eq as eq8 } from "drizzle-orm";
 
 // src/errors.ts
@@ -1000,16 +1022,11 @@ var AUTH_ERRORS = {
 };
 
 // src/lib/normalize-user.ts
-var normalizeUser = (user) => {
-  return {
-    ...user,
-    userRoles: user.userRoles ? user.userRoles.map((role) => ({
-      ...role,
-      name: typeof role.name === "string" ? role.name : "",
-      description: typeof role.description === "string" ? role.description : ""
-    })) : null
-  };
-};
+var normalizeUser = (user) => ({
+  ...user,
+  roles: user.roles ?? null,
+  roleCodes: user.roleCodes ?? null
+});
 
 // src/lib/session.ts
 import { dayjs } from "@mesob/common";
@@ -1258,7 +1275,8 @@ var createUserWithAccount = async ({
     email: email || null,
     phone: phone || null,
     emailVerified: email ? !config.email.required : false,
-    phoneVerified: phone ? !config.phone.required : false
+    phoneVerified: phone ? !config.phone.required : false,
+    userType: [config.userType]
   }).returning();
   const passwordHash = await hashPassword(password);
   await tx.insert(accountsInIam).values({
@@ -1270,16 +1288,44 @@ var createUserWithAccount = async ({
   });
   return user;
 };
-var fetchUserByIdentifier = async ({
+var fetchUserForLogin = async ({
   database,
   identifier,
   tenantId,
-  isEmail
+  isEmail,
+  userType
 }) => {
+  const userTypeFilter = sql6`${usersInIam.userType} @> ARRAY[${userType}]::text[]`;
   const whereClause = isEmail ? and6(
     eq6(usersInIam.tenantId, tenantId),
+    userTypeFilter,
     sql6`lower(${usersInIam.email}) = lower(${identifier})`
-  ) : and6(eq6(usersInIam.tenantId, tenantId), eq6(usersInIam.phone, identifier));
+  ) : and6(
+    eq6(usersInIam.tenantId, tenantId),
+    userTypeFilter,
+    eq6(usersInIam.phone, identifier)
+  );
+  const [row] = await database.select({
+    id: usersInIam.id,
+    tenantId: usersInIam.tenantId,
+    fullName: usersInIam.fullName,
+    email: usersInIam.email,
+    phone: usersInIam.phone,
+    handle: usersInIam.handle,
+    image: usersInIam.image,
+    emailVerified: usersInIam.emailVerified,
+    phoneVerified: usersInIam.phoneVerified,
+    lastSignInAt: usersInIam.lastSignInAt,
+    bannedUntil: usersInIam.bannedUntil,
+    loginAttempt: usersInIam.loginAttempt
+  }).from(usersInIam).where(whereClause).limit(1);
+  return row || null;
+};
+var fetchUserByIdWithRoles = async ({
+  database,
+  userId,
+  tenantId
+}) => {
   const [result] = await database.select({
     id: usersInIam.id,
     tenantId: usersInIam.tenantId,
@@ -1293,20 +1339,18 @@ var fetchUserByIdentifier = async ({
     lastSignInAt: usersInIam.lastSignInAt,
     bannedUntil: usersInIam.bannedUntil,
     loginAttempt: usersInIam.loginAttempt,
-    userRoles: sql6`
-        COALESCE(
-          json_agg(
-            json_build_object(
-              'id', ${userRolesInIam.id},
-              'roleId', ${rolesInIam.id},
-              'code', ${rolesInIam.code},
-              'name', ${rolesInIam.name},
-              'description', ${rolesInIam.description}
-            )
-          ) FILTER (WHERE ${userRolesInIam.id} IS NOT NULL),
-          '[]'::json
-        )
-      `
+    roles: sql6`COALESCE(
+        array_to_json(array_agg(DISTINCT ${rolesInIam.id}) FILTER (WHERE ${userRolesInIam.id} IS NOT NULL)),
+        '[]'::json
+      )`,
+    roleCodes: sql6`COALESCE(
+        array_to_json(array_agg(DISTINCT ${rolesInIam.code}) FILTER (WHERE ${rolesInIam.code} IS NOT NULL)),
+        '[]'::json
+      )`,
+    permissions: sql6`COALESCE(
+        array_to_json(array_agg(DISTINCT ${permissionsInIam.id}) FILTER (WHERE ${permissionsInIam.id} IS NOT NULL)),
+        '[]'::json
+      )`
   }).from(usersInIam).leftJoin(
     userRolesInIam,
     and6(
@@ -1319,7 +1363,16 @@ var fetchUserByIdentifier = async ({
       eq6(userRolesInIam.roleId, rolesInIam.id),
       eq6(rolesInIam.tenantId, tenantId)
     )
-  ).where(whereClause).groupBy(usersInIam.id).limit(1);
+  ).leftJoin(
+    rolePermissionsInIam,
+    and6(
+      eq6(rolePermissionsInIam.roleId, rolesInIam.id),
+      eq6(rolePermissionsInIam.tenantId, tenantId)
+    )
+  ).leftJoin(
+    permissionsInIam,
+    eq6(rolePermissionsInIam.permissionId, permissionsInIam.id)
+  ).where(and6(eq6(usersInIam.id, userId), eq6(usersInIam.tenantId, tenantId))).groupBy(usersInIam.id).limit(1);
   return result || null;
 };
 
@@ -1535,16 +1588,26 @@ var signInHandler = async (c) => {
   if (!(isEmail || config.phone.enabled)) {
     return c.json({ error: "Phone authentication is disabled" }, 401);
   }
-  const user = await fetchUserByIdentifier({
+  const user = await fetchUserForLogin({
     database,
     identifier,
     tenantId: resolvedTenantId,
-    isEmail
+    isEmail,
+    userType: config.userType
   });
   if (!user) {
+    logger2.log("[sign-in] 401: user not found", {
+      identifier,
+      tenantId: resolvedTenantId,
+      userType: config.userType
+    });
     return c.json({ error: AUTH_ERRORS.UNAUTHORIZED }, 401);
   }
   if (user.bannedUntil && new Date(user.bannedUntil) > /* @__PURE__ */ new Date()) {
+    logger2.log("[sign-in] 401: account banned", {
+      userId: user.id,
+      bannedUntil: user.bannedUntil
+    });
     return c.json(
       {
         error: "Account locked. Try again later.",
@@ -1568,6 +1631,7 @@ var signInHandler = async (c) => {
     )
   ).limit(1);
   if (!account?.password) {
+    logger2.log("[sign-in] 401: no credentials account", { userId: user.id });
     return c.json({ error: AUTH_ERRORS.UNAUTHORIZED }, 401);
   }
   const passwordValid = await verifyPassword(password, account.password);
@@ -1585,13 +1649,17 @@ var signInHandler = async (c) => {
         eq8(usersInIam.tenantId, resolvedTenantId)
       )
     );
+    logger2.log("[sign-in] 401: invalid password", {
+      userId: user.id,
+      loginAttempt: newAttempt
+    });
     return c.json({ error: AUTH_ERRORS.UNAUTHORIZED }, 401);
   }
   const isVerified = isEmail ? user.emailVerified : user.phoneVerified;
   if (isEmail && config.email.required && !isVerified) {
     return handleEmailVerification({
       c,
-      user,
+      user: { ...user, roles: [] },
       config,
       database,
       tenantId: resolvedTenantId
@@ -1600,7 +1668,7 @@ var signInHandler = async (c) => {
   if (!isEmail && config.phone.required && !isVerified) {
     return handlePhoneVerification({
       c,
-      user,
+      user: { ...user, roles: [] },
       config,
       database,
       tenantId: resolvedTenantId
@@ -1641,22 +1709,24 @@ var signInHandler = async (c) => {
     userId: sessionsInIam.userId,
     expiresAt: sessionsInIam.expiresAt,
     createdAt: sessionsInIam.createdAt,
-    updatedAt: sessionsInIam.updatedAt,
-    userAgent: sessionsInIam.userAgent,
-    ip: sessionsInIam.ip
+    meta: sessionsInIam.meta
   });
   setSessionCookie(c, sessionToken, config, {
     expires: new Date(expiresAt)
   });
+  const fullUser = await fetchUserByIdWithRoles({
+    database,
+    userId: user.id,
+    tenantId: resolvedTenantId
+  });
   return c.json(
     {
-      user: normalizeUser(user),
+      user: normalizeUser(fullUser ?? { ...user, roles: [] }),
       session: {
         id: session.id,
         expiresAt: session.expiresAt,
         createdAt: session.createdAt,
-        userAgent: session.userAgent,
-        ip: session.ip
+        meta: session.meta
       },
       sessionExpiresAt: session.expiresAt
     },
@@ -2736,20 +2806,10 @@ var forgotPasswordHandler = async (c) => {
       emailVerified: usersInIam.emailVerified,
       phoneVerified: usersInIam.phoneVerified,
       lastSignInAt: usersInIam.lastSignInAt,
-      userRoles: sql11`
-          COALESCE(
-            json_agg(
-              json_build_object(
-                'id', ${userRolesInIam.id},
-                'roleId', ${rolesInIam.id},
-                'code', ${rolesInIam.code},
-                'name', ${rolesInIam.name},
-                'description', ${rolesInIam.description}
-              )
-            ) FILTER (WHERE ${userRolesInIam.id} IS NOT NULL),
-            '[]'::json
-          )
-        `
+      roles: sql11`COALESCE(
+          array_to_json(array_agg(${rolesInIam.id}) FILTER (WHERE ${userRolesInIam.id} IS NOT NULL)),
+          '[]'::json
+        )`
     }).from(usersInIam).leftJoin(
       userRolesInIam,
       and18(
@@ -2781,20 +2841,10 @@ var forgotPasswordHandler = async (c) => {
       emailVerified: usersInIam.emailVerified,
       phoneVerified: usersInIam.phoneVerified,
       lastSignInAt: usersInIam.lastSignInAt,
-      userRoles: sql11`
-          COALESCE(
-            json_agg(
-              json_build_object(
-                'id', ${userRolesInIam.id},
-                'roleId', ${rolesInIam.id},
-                'code', ${rolesInIam.code},
-                'name', ${rolesInIam.name},
-                'description', ${rolesInIam.description}
-              )
-            ) FILTER (WHERE ${userRolesInIam.id} IS NOT NULL),
-            '[]'::json
-          )
-        `
+      roles: sql11`COALESCE(
+          array_to_json(array_agg(${rolesInIam.id}) FILTER (WHERE ${userRolesInIam.id} IS NOT NULL)),
+          '[]'::json
+        )`
     }).from(usersInIam).leftJoin(
       userRolesInIam,
       and18(
@@ -3739,9 +3789,7 @@ var sessionHandler = (c) => {
         session: {
           id: session.id,
           expiresAt: session.expiresAt,
-          createdAt: session.createdAt,
-          userAgent: session.userAgent,
-          ip: session.ip
+          createdAt: session.createdAt
         }
       },
       200
@@ -3966,9 +4014,7 @@ var sessionRoute = createRoute7({
             session: z4.object({
               id: z4.string().uuid(),
               expiresAt: z4.string().datetime(),
-              createdAt: z4.string().datetime(),
-              userAgent: z4.string().nullable(),
-              ip: z4.string().nullable()
+              createdAt: z4.string().datetime()
             }).nullable()
           })
         }
@@ -4332,6 +4378,7 @@ var role_permissions_route_default = rolePermissionRoutes;
 import { createRoute as createRoute9, OpenAPIHono as OpenAPIHono9 } from "@hono/zod-openapi";
 
 // src/routes/roles/handler/create-role.ts
+import { randomUUID } from "crypto";
 var createRoleHandler = async (c) => {
   const body = c.req.valid("json");
   const config = c.get("config");
@@ -4339,6 +4386,7 @@ var createRoleHandler = async (c) => {
   const tenantId = c.get("tenantId");
   const resolvedTenantId = ensureTenantId(config, tenantId);
   const [role] = await database.insert(rolesInIam).values({
+    id: randomUUID(),
     tenantId: resolvedTenantId,
     name: body.name,
     description: body.description,
@@ -4880,7 +4928,44 @@ import { createRoute as createRoute12, OpenAPIHono as OpenAPIHono12 } from "@hon
 
 // src/routes/tenants/handler/create-tenant.ts
 import { eq as eq38 } from "drizzle-orm";
+
+// src/lib/has-role-permission.ts
+import { HTTPException as HTTPException3 } from "hono/http-exception";
+var toArray = (v) => {
+  return Array.isArray(v) ? v : [v];
+};
+var hasRole = (c, role) => {
+  const user = c.get("user");
+  const codes = user?.roleCodes;
+  if (!codes?.length) {
+    return false;
+  }
+  const check2 = toArray(role);
+  return check2.some((r) => codes.includes(r));
+};
+var hasRoleThrow = (c, role) => {
+  if (!hasRole(c, role)) {
+    throw new HTTPException3(401, { message: "Unauthorized" });
+  }
+};
+var hasPermission = (c, permission) => {
+  const user = c.get("user");
+  const perms = user?.permissions;
+  if (!perms?.length) {
+    return false;
+  }
+  const check2 = toArray(permission);
+  return check2.some((p) => perms.includes(p));
+};
+var hasPermissionThrow = (c, permission) => {
+  if (!hasPermission(c, permission)) {
+    throw new HTTPException3(401, { message: "Unauthorized" });
+  }
+};
+
+// src/routes/tenants/handler/create-tenant.ts
 var createTenantHandler = async (c) => {
+  hasRoleThrow(c, ["owner", "tenant-admin"]);
   const body = c.req.valid("json");
   const database = c.get("database");
   const [existing] = await database.select().from(tenantsInIam).where(eq38(tenantsInIam.id, body.id)).limit(1);
@@ -4908,6 +4993,7 @@ var createTenantHandler = async (c) => {
 // src/routes/tenants/handler/delete-tenant.ts
 import { eq as eq39 } from "drizzle-orm";
 var deleteTenantHandler = async (c) => {
+  hasRoleThrow(c, ["owner", "tenant-admin"]);
   const { id } = c.req.valid("param");
   const database = c.get("database");
   const [existing] = await database.select().from(tenantsInIam).where(eq39(tenantsInIam.id, id)).limit(1);
@@ -4921,6 +5007,7 @@ var deleteTenantHandler = async (c) => {
 // src/routes/tenants/handler/get-tenant.ts
 import { eq as eq40 } from "drizzle-orm";
 var getTenantHandler = async (c) => {
+  hasRoleThrow(c, ["owner", "tenant-admin"]);
   const { id } = c.req.valid("param");
   const database = c.get("database");
   const [tenant] = await database.select().from(tenantsInIam).where(eq40(tenantsInIam.id, id)).limit(1);
@@ -4931,8 +5018,14 @@ var getTenantHandler = async (c) => {
 };
 
 // src/routes/tenants/handler/list-tenants.ts
-import { and as and38, eq as eq41, sql as sql20 } from "drizzle-orm";
+import { and as and38, asc as asc2, desc as desc2, eq as eq41, ilike as ilike2, or, sql as sql20 } from "drizzle-orm";
+var sortColumnMap = {
+  createdAt: tenantsInIam.createdAt,
+  updatedAt: tenantsInIam.updatedAt,
+  name: sql20`${tenantsInIam.name}::text`
+};
 var listTenantsHandler = async (c) => {
+  hasRoleThrow(c, ["owner", "tenant-admin"]);
   const query = c.req.valid("query");
   const database = c.get("database");
   const page = query.page || 1;
@@ -4942,9 +5035,27 @@ var listTenantsHandler = async (c) => {
   if (query.isActive !== void 0) {
     conditions.push(eq41(tenantsInIam.isActive, query.isActive));
   }
+  if (query.filter === "isActive:true") {
+    conditions.push(eq41(tenantsInIam.isActive, true));
+  } else if (query.filter === "isActive:false") {
+    conditions.push(eq41(tenantsInIam.isActive, false));
+  }
+  if (query.search?.trim()) {
+    const term = `%${query.search.trim()}%`;
+    const searchCond = or(
+      ilike2(tenantsInIam.id, term),
+      ilike2(sql20`${tenantsInIam.name}::text`, term)
+    );
+    if (searchCond) {
+      conditions.push(searchCond);
+    }
+  }
+  const orderDir = query.order === "asc" ? asc2 : desc2;
+  const sortCol = query.sort && sortColumnMap[query.sort] ? sortColumnMap[query.sort] : tenantsInIam.createdAt;
+  const whereClause = conditions.length > 0 ? and38(...conditions) : void 0;
   const [tenants, totalResult] = await Promise.all([
-    database.select().from(tenantsInIam).where(conditions.length > 0 ? and38(...conditions) : void 0).limit(limit).offset(offset),
-    database.select({ count: sql20`count(*)` }).from(tenantsInIam).where(conditions.length > 0 ? and38(...conditions) : void 0)
+    database.select().from(tenantsInIam).where(whereClause).orderBy(orderDir(sortCol)).limit(limit).offset(offset),
+    database.select({ count: sql20`count(*)` }).from(tenantsInIam).where(whereClause)
   ]);
   const total = Number(totalResult[0]?.count || 0);
   return c.json({ tenants, total, page, limit }, 200);
@@ -4953,6 +5064,7 @@ var listTenantsHandler = async (c) => {
 // src/routes/tenants/handler/update-tenant.ts
 import { eq as eq42, sql as sql21 } from "drizzle-orm";
 var updateTenantHandler = async (c) => {
+  hasRoleThrow(c, ["owner", "tenant-admin"]);
   const { id } = c.req.valid("param");
   const body = c.req.valid("json");
   const database = c.get("database");
@@ -5009,10 +5121,16 @@ var updateTenantHandler = async (c) => {
 
 // src/routes/tenants/tenants.schema.ts
 import { z as z9 } from "zod";
+var tenantSortFields = ["createdAt", "updatedAt", "name"];
+var tenantFilterValues = ["", "isActive:true", "isActive:false"];
 var listTenantsQuerySchema = z9.object({
   page: z9.coerce.number().min(1).default(1).optional(),
   limit: z9.coerce.number().min(1).max(100).default(20).optional(),
-  isActive: z9.coerce.boolean().optional()
+  isActive: z9.coerce.boolean().optional(),
+  search: z9.string().optional(),
+  filter: z9.enum(tenantFilterValues).optional(),
+  sort: z9.enum(tenantSortFields).optional(),
+  order: z9.enum(["asc", "desc"]).optional()
 });
 var tenantIdParamSchema = z9.object({
   id: z9.string()
@@ -5296,17 +5414,17 @@ var assignUserRoleSchema = z10.object({
   userId: z10.uuid(),
   roleId: z10.uuid()
 });
-var userRoleSchema2 = z10.object({
+var userRoleSchema = z10.object({
   id: z10.uuid(),
   tenantId: z10.string(),
   userId: z10.uuid(),
   roleId: z10.uuid()
 });
 var listUserRolesResponseSchema = z10.object({
-  userRoles: z10.array(userRoleSchema2)
+  userRoles: z10.array(userRoleSchema)
 });
 var userRoleResponseSchema = z10.object({
-  userRole: userRoleSchema2
+  userRole: userRoleSchema
 });
 var revokeUserRoleResponseSchema = z10.object({
   message: z10.string()
@@ -5547,7 +5665,14 @@ var getUserHandler = async (c) => {
 };
 
 // src/routes/users/handler/list-users.ts
-import { and as and44, eq as eq48, ilike as ilike2, sql as sql24 } from "drizzle-orm";
+import { and as and44, asc as asc3, desc as desc3, eq as eq48, ilike as ilike3, sql as sql24 } from "drizzle-orm";
+var sortColumnMap2 = {
+  createdAt: usersInIam.createdAt,
+  updatedAt: usersInIam.updatedAt,
+  fullName: usersInIam.fullName,
+  handle: usersInIam.handle,
+  lastSignInAt: usersInIam.lastSignInAt
+};
 var listUsersHandler = async (c) => {
   const query = c.req.valid("query");
   const database = c.get("database");
@@ -5557,14 +5682,24 @@ var listUsersHandler = async (c) => {
   const offset = (page - 1) * limit;
   const conditions = [eq48(usersInIam.tenantId, tenantId)];
   if (query.email) {
-    conditions.push(ilike2(usersInIam.email, `%${query.email}%`));
+    conditions.push(ilike3(usersInIam.email, `%${query.email}%`));
   }
   if (query.phone) {
-    conditions.push(ilike2(usersInIam.phone, `%${query.phone}%`));
+    conditions.push(ilike3(usersInIam.phone, `%${query.phone}%`));
   }
   if (query.handle) {
-    conditions.push(ilike2(usersInIam.handle, `%${query.handle}%`));
-  }
+    conditions.push(ilike3(usersInIam.handle, `%${query.handle}%`));
+  }
+  if (query.filter === "emailVerified") {
+    conditions.push(eq48(usersInIam.emailVerified, true));
+  } else if (query.filter === "phoneVerified") {
+    conditions.push(eq48(usersInIam.phoneVerified, true));
+  } else if (query.filter === "notVerified") {
+    conditions.push(eq48(usersInIam.emailVerified, false));
+    conditions.push(eq48(usersInIam.phoneVerified, false));
+  }
+  const orderDir = query.order === "asc" ? asc3 : desc3;
+  const sortCol = query.sort && sortColumnMap2[query.sort] ? sortColumnMap2[query.sort] : usersInIam.createdAt;
   const [users, totalResult] = await Promise.all([
     database.select({
       id: usersInIam.id,
@@ -5577,7 +5712,7 @@ var listUsersHandler = async (c) => {
       emailVerified: usersInIam.emailVerified,
       phoneVerified: usersInIam.phoneVerified,
       lastSignInAt: usersInIam.lastSignInAt
-    }).from(usersInIam).where(and44(...conditions)).limit(limit).offset(offset),
+    }).from(usersInIam).where(and44(...conditions)).orderBy(orderDir(sortCol)).limit(limit).offset(offset),
     database.select({ count: sql24`count(*)` }).from(usersInIam).where(and44(...conditions))
   ]);
   const total = Number(totalResult[0]?.count || 0);
@@ -5585,7 +5720,7 @@ var listUsersHandler = async (c) => {
     {
       users: users.map((u) => ({
         ...u,
-        userRoles: null
+        roles: null
       })),
       total,
       page,
@@ -5596,7 +5731,7 @@ var listUsersHandler = async (c) => {
 };
 
 // src/routes/users/handler/search-users.ts
-import { and as and45, eq as eq49, ilike as ilike3, or } from "drizzle-orm";
+import { and as and45, eq as eq49, ilike as ilike4, or as or2 } from "drizzle-orm";
 var searchUsersHandler = async (c) => {
   const query = c.req.valid("query");
   const database = c.get("database");
@@ -5604,10 +5739,10 @@ var searchUsersHandler = async (c) => {
   const limit = query.limit || 20;
   const conditions = [eq49(usersInIam.tenantId, tenantId)];
   if (query.search && query.search.trim().length > 0) {
-    const searchCondition = or(
-      ilike3(usersInIam.fullName, `%${query.search}%`),
-      ilike3(usersInIam.email, `%${query.search}%`),
-      ilike3(usersInIam.handle, `%${query.search}%`)
+    const searchCondition = or2(
+      ilike4(usersInIam.fullName, `%${query.search}%`),
+      ilike4(usersInIam.email, `%${query.search}%`),
+      ilike4(usersInIam.handle, `%${query.search}%`)
     );
     if (searchCondition) {
       conditions.push(searchCondition);
@@ -5691,13 +5826,29 @@ var updateUserHandler = async (c) => {
 
 // src/routes/users/users.schema.ts
 import { z as z11 } from "zod";
+var sortableFields = [
+  "createdAt",
+  "updatedAt",
+  "fullName",
+  "handle",
+  "lastSignInAt"
+];
+var filterValues = [
+  "",
+  "emailVerified",
+  "phoneVerified",
+  "notVerified"
+];
 var listUsersQuerySchema = z11.object({
   page: z11.coerce.number().min(1).default(1).optional(),
   limit: z11.coerce.number().min(1).max(100).default(20).optional(),
   tenantId: z11.string().optional(),
   email: z11.string().optional(),
   phone: z11.string().optional(),
-  handle: z11.string().optional()
+  handle: z11.string().optional(),
+  filter: z11.enum(filterValues).optional(),
+  sort: z11.enum(sortableFields).optional(),
+  order: z11.enum(["asc", "desc"]).optional()
 });
 var userIdParamSchema2 = z11.object({
   id: z11.uuid()
@@ -6314,9 +6465,9 @@ var createSessionMiddleware = () => {
 };
 
 // src/middlewares/tenant-middleware.ts
-import { logger as logger2 } from "@mesob/common";
+import { logger as logger3 } from "@mesob/common";
 import { createMiddleware as createMiddleware2 } from "hono/factory";
-import { HTTPException as HTTPException3 } from "hono/http-exception";
+import { HTTPException as HTTPException4 } from "hono/http-exception";
 function resolveHost(hostHeader, forwardedHost) {
   const hostHeaderStr = hostHeader || "";
   const forwardedHostStr = forwardedHost || "";
@@ -6356,7 +6507,7 @@ async function resolveTenant(database, config, host) {
     }
     return { tenantId, tenant };
   } catch (err) {
-    logger2.error("Tenant resolution error:", err);
+    logger3.error("Tenant resolution error:", err);
     throw err;
   }
 }
@@ -6380,7 +6531,7 @@ var createTenantMiddleware = (database, config) => {
     );
     c.set("host", host);
     if (!host) {
-      throw new HTTPException3(400, { message: "Missing Host header" });
+      throw new HTTPException4(400, { message: "Missing Host header" });
     }
     let tenantId = null;
     let tenant = null;
@@ -6389,13 +6540,13 @@ var createTenantMiddleware = (database, config) => {
       tenantId = result.tenantId;
       tenant = result.tenant;
     } catch {
-      throw new HTTPException3(500, { message: "Tenant resolution failed" });
+      throw new HTTPException4(500, { message: "Tenant resolution failed" });
     }
     c.set("tenantId", tenantId);
     c.set("tenant", tenant);
     const error = validateTenant(tenantId, tenant);
     if (error) {
-      throw new HTTPException3(404, { message: error });
+      throw new HTTPException4(404, { message: error });
     }
     return await next();
   });
@@ -6483,10 +6634,10 @@ var createGetSession = (database, config) => {
 };
 
 // src/types/index.ts
-import { logger as logger3 } from "@mesob/common";
+import { logger as logger4 } from "@mesob/common";
 var createDefaultSendVerificationOTP = (expiresIn) => {
   return (params) => {
-    logger3.log(
+    logger4.log(
       `[Verification OTP] Code: ${params.code}, Hash: ${params.hash}, ExpiresIn: ${expiresIn}, Type: ${params.type}`
     );
   };
@@ -6595,6 +6746,10 @@ export {
   createDatabase,
   createMesobAuth,
   createSessionMiddleware,
-  createTenantMiddleware
+  createTenantMiddleware,
+  hasPermission,
+  hasPermissionThrow,
+  hasRole,
+  hasRoleThrow
 };
 //# sourceMappingURL=index.js.map