@mesob/auth-hono 0.4.5 → 0.4.7

package/dist/{index-BNJj_z2x.d.ts → index-DssTTD4U.d.ts}

@@ -3,6 +3,13 @@ import { OpenAPIHono } from '@hono/zod-openapi';
 import { PermissionTree } from '@mesob/common';
 import { D as Database } from './index-Cb7JZobZ.js';
 
+type Tenant = {
+    id: string;
+    name: unknown;
+    description: unknown;
+    isActive: boolean;
+};
+
 type SessionStatus = 'valid' | 'no_cookie' | 'invalid_session' | 'user_not_found' | 'error';
 
 type AuthEnv = {
@@ -10,6 +17,8 @@ type AuthEnv = {
         config: AuthConfig;
         database: Database;
         tenantId: string;
+        tenant?: Tenant | null;
+        host?: string | null;
         userId?: string;
         user?: User;
         session?: Session;
@@ -156,4 +165,4 @@ type MesobAuth = {
     sessionMiddleware: hono.MiddlewareHandler;
 };
 
-export type { AuthConfig as A, MesobAuth as M, SessionStatus as S, User as U, SendInvitationParams as a, SendVerificationOTPParams as b, Session as c, SeedRole as d, SessionConfig as e };
+export type { AuthConfig as A, MesobAuth as M, SessionStatus as S, Tenant as T, User as U, SendInvitationParams as a, SendVerificationOTPParams as b, Session as c, SeedRole as d, SessionConfig as e };

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-import { A as AuthConfig, M as MesobAuth } from './index-BNJj_z2x.js';
-export { a as SendInvitationParams, b as SendVerificationOTPParams, c as Session, S as SessionStatus, U as User } from './index-BNJj_z2x.js';
+import { A as AuthConfig, M as MesobAuth } from './index-DssTTD4U.js';
+export { a as SendInvitationParams, b as SendVerificationOTPParams, c as Session, S as SessionStatus, T as Tenant, U as User } from './index-DssTTD4U.js';
 import { D as Database } from './index-Cb7JZobZ.js';
 export { c as createDatabase } from './index-Cb7JZobZ.js';
 export { cleanupExpiredData, cleanupExpiredSessions, cleanupExpiredVerifications } from './lib/cleanup.js';
-export { hasPermission, hasPermissionThrow, hasRole, hasRoleThrow } from './lib/has-role-permission.js';
+export { hasPermission, hasPermissionThrow } from './lib/has-role-permission.js';
 import * as hono from 'hono';
 import '@hono/zod-openapi';
 import '@mesob/common';
@@ -12,17 +12,10 @@ import 'drizzle-orm/pg-core';
 import 'drizzle-orm';
 import 'pg';
 
-type Tenant = {
-    id: string;
-    name: unknown;
-    description: unknown;
-    isActive: boolean;
-};
-
 declare const createSessionMiddleware: () => hono.MiddlewareHandler<any, string, {}, Response>;
 
 declare const createTenantMiddleware: (database: Database, config: AuthConfig) => hono.MiddlewareHandler<any, string, {}, Response>;
 
 declare const createMesobAuth: (authConfig: AuthConfig) => MesobAuth;
 
-export { AuthConfig, Database, MesobAuth, type Tenant, createMesobAuth, createSessionMiddleware, createTenantMiddleware };
+export { AuthConfig, Database, MesobAuth, createMesobAuth, createSessionMiddleware, createTenantMiddleware };

package/dist/index.js

@@ -612,6 +612,7 @@ var fetchUserWithRoles = async ({
     emailVerified: usersInIam.emailVerified,
     phoneVerified: usersInIam.phoneVerified,
     lastSignInAt: usersInIam.lastSignInAt,
+    bannedUntil: usersInIam.bannedUntil,
     ...getUserAuthSelect(tenantId)
   }).from(usersInIam).where(and4(eq4(usersInIam.id, userId), eq4(usersInIam.tenantId, tenantId))).limit(1);
   return userResult || null;
@@ -862,6 +863,7 @@ var userSchema = z.object({
   emailVerified: z.boolean(),
   phoneVerified: z.boolean(),
   lastSignInAt: z.string().datetime().nullable(),
+  bannedUntil: z.string().datetime().nullable().optional(),
   createdAt: z.string().datetime().nullable().optional(),
   userType: z.array(z.string()).optional(),
   roles: z.array(z.string()).nullable().optional(),
@@ -2171,6 +2173,24 @@ var auth_route_default = authRoutes;
 // src/routes/domains/domains.route.ts
 import { createRoute as createRoute2, OpenAPIHono as OpenAPIHono2 } from "@hono/zod-openapi";
 
+// src/lib/has-role-permission.ts
+import { grant } from "@mesob/common";
+import { HTTPException as HTTPException3 } from "hono/http-exception";
+var toArray = (v) => {
+  return Array.isArray(v) ? v : [v];
+};
+var hasPermission = (c, permission) => {
+  const user = c.get("user");
+  const perms = user?.permissions;
+  const check2 = toArray(permission);
+  return grant(check2, perms);
+};
+var hasPermissionThrow = (c, permission) => {
+  if (!hasPermission(c, permission)) {
+    throw new HTTPException3(401, { message: "Unauthorized" });
+  }
+};
+
 // src/routes/domains/domains.schema.ts
 import { z as z2 } from "zod";
 var listDomainsQuerySchema = z2.object({
@@ -2230,10 +2250,11 @@ var createDomainHandler = async (c) => {
   const database = c.get("database");
   const tenantId = c.get("tenantId");
   const resolvedTenantId = ensureTenantId(config, tenantId);
+  const status = (body.status || "pending").toUpperCase();
   const [domain] = await database.insert(domainsInIam).values({
     tenantId: resolvedTenantId,
     domain: body.domain,
-    status: body.status || "pending",
+    status,
     meta: body.meta || null,
     isPrimary: body.isPrimary
   }).returning();
@@ -2278,7 +2299,7 @@ var listDomainsHandler = async (c) => {
   const offset = (page - 1) * limit;
   const conditions = [eq13(domainsInIam.tenantId, tenantId)];
   if (query.status) {
-    conditions.push(eq13(domainsInIam.status, query.status));
+    conditions.push(eq13(domainsInIam.status, query.status.toUpperCase()));
   }
   const [domains, totalResult] = await Promise.all([
     database.select().from(domainsInIam).where(and13(...conditions)).limit(limit).offset(offset),
@@ -2304,7 +2325,7 @@ var updateDomainHandler = async (c) => {
     updateData.domain = body.domain;
   }
   if (body.status !== void 0) {
-    updateData.status = body.status;
+    updateData.status = body.status.toUpperCase();
   }
   if (body.meta !== void 0) {
     updateData.meta = body.meta;
@@ -2502,7 +2523,12 @@ var verifyDomainRoute = createRoute2({
     }
   }
 });
-var domainRoutes = new OpenAPIHono2().openapi(listDomainsRoute, listDomainsHandler).openapi(getDomainRoute, getDomainHandler).openapi(createDomainRoute, createDomainHandler).openapi(updateDomainRoute, updateDomainHandler).openapi(deleteDomainRoute, deleteDomainHandler).openapi(verifyDomainRoute, verifyDomainHandler);
+var IAM_ALL = "iam:all:all";
+var domainRoutesBase = new OpenAPIHono2().use("*", (c, next) => {
+  hasPermissionThrow(c, IAM_ALL);
+  return next();
+});
+var domainRoutes = domainRoutesBase.openapi(listDomainsRoute, listDomainsHandler).openapi(getDomainRoute, getDomainHandler).openapi(createDomainRoute, createDomainHandler).openapi(updateDomainRoute, updateDomainHandler).openapi(deleteDomainRoute, deleteDomainHandler).openapi(verifyDomainRoute, verifyDomainHandler);
 var domains_route_default = domainRoutes;
 
 // src/routes/email/email.route.ts
@@ -3549,7 +3575,7 @@ import {
   notInArray,
   sql as sql12
 } from "drizzle-orm";
-import { HTTPException as HTTPException3 } from "hono/http-exception";
+import { HTTPException as HTTPException4 } from "hono/http-exception";
 function buildPermissionDescription(code) {
   return {
     en: toTitleCase(code.replaceAll(":", " ").replaceAll("_", " "))
@@ -3606,7 +3632,7 @@ async function assertPermissionsExist({
     (id) => !existingIds.has(id)
   );
   if (missingPermissionIds.length) {
-    throw new HTTPException3(400, {
+    throw new HTTPException4(400, {
       message: `Unknown permissions: ${missingPermissionIds.join(", ")}`
     });
   }
@@ -3856,7 +3882,12 @@ var seedPermissionsRoute = createRoute5({
     }
   }
 });
-var permissionRoutes = new OpenAPIHono5().openapi(listPermissionsRoute, listPermissionsHandler).openapi(seedPermissionsRoute, seedPermissionsHandler).openapi(getPermissionRoute, getPermissionHandler);
+var IAM_ALL2 = "iam:all:all";
+var permissionRoutesBase = new OpenAPIHono5().use("*", (c, next) => {
+  hasPermissionThrow(c, IAM_ALL2);
+  return next();
+});
+var permissionRoutes = permissionRoutesBase.openapi(listPermissionsRoute, listPermissionsHandler).openapi(seedPermissionsRoute, seedPermissionsHandler).openapi(getPermissionRoute, getPermissionHandler);
 var permissions_route_default = permissionRoutes;
 
 // src/routes/phone/phone.route.ts
@@ -4890,7 +4921,15 @@ var revokeRolePermissionRoute = createRoute8({
     }
   }
 });
-var rolePermissionRoutes = new OpenAPIHono8().openapi(listRolePermissionsRoute, listRolePermissionsHandler).openapi(assignRolePermissionRoute, assignRolePermissionHandler).openapi(revokeRolePermissionRoute, revokeRolePermissionHandler);
+var IAM_ALL3 = "iam:all:all";
+var rolePermissionRoutesBase = new OpenAPIHono8().use(
+  "*",
+  (c, next) => {
+    hasPermissionThrow(c, IAM_ALL3);
+    return next();
+  }
+);
+var rolePermissionRoutes = rolePermissionRoutesBase.openapi(listRolePermissionsRoute, listRolePermissionsHandler).openapi(assignRolePermissionRoute, assignRolePermissionHandler).openapi(revokeRolePermissionRoute, revokeRolePermissionHandler);
 var role_permissions_route_default = rolePermissionRoutes;
 
 // src/routes/roles/roles.route.ts
@@ -6050,7 +6089,12 @@ var seedRolesRoute = createRoute9({
     }
   }
 });
-var roleRoutes = new OpenAPIHono9().openapi(listRolesRoute, listRolesHandler).openapi(seedRolesRoute, seedRolesHandler).openapi(getRoleRoute, getRoleHandler).openapi(createRoleRoute, createRoleHandler).openapi(updateRoleRoute, updateRoleHandler).openapi(listRolePermissionsRoute2, listRolePermissionsHandler2).openapi(assignRolePermissionsRoute, assignRolePermissionsHandler).openapi(revokeRolePermissionRoute2, revokeRolePermissionHandler2).openapi(listRoleUsersRoute, listRoleUsersHandler).openapi(assignRoleUsersRoute, assignRoleUsersHandler).openapi(revokeRoleUserRoute, revokeRoleUserHandler).openapi(deleteRoleRoute, deleteRoleHandler);
+var IAM_ALL4 = "iam:all:all";
+var roleRoutesBase = new OpenAPIHono9().use("*", (c, next) => {
+  hasPermissionThrow(c, IAM_ALL4);
+  return next();
+});
+var roleRoutes = roleRoutesBase.openapi(listRolesRoute, listRolesHandler).openapi(seedRolesRoute, seedRolesHandler).openapi(getRoleRoute, getRoleHandler).openapi(createRoleRoute, createRoleHandler).openapi(updateRoleRoute, updateRoleHandler).openapi(listRolePermissionsRoute2, listRolePermissionsHandler2).openapi(assignRolePermissionsRoute, assignRolePermissionsHandler).openapi(revokeRolePermissionRoute2, revokeRolePermissionHandler2).openapi(listRoleUsersRoute, listRoleUsersHandler).openapi(assignRoleUsersRoute, assignRoleUsersHandler).openapi(revokeRoleUserRoute, revokeRoleUserHandler).openapi(deleteRoleRoute, deleteRoleHandler);
 var roles_route_default = roleRoutes;
 
 // src/routes/sessions/sessions.route.ts
@@ -6253,7 +6297,12 @@ var revokeAllSessionsRoute = createRoute10({
     }
   }
 });
-var sessionRoutes = new OpenAPIHono10().openapi(listSessionsRoute, listSessionsHandler).openapi(getSessionRoute, getSessionHandler).openapi(revokeSessionRoute, revokeSessionHandler).openapi(revokeAllSessionsRoute, revokeAllSessionsHandler);
+var IAM_ALL5 = "iam:all:all";
+var sessionRoutesBase = new OpenAPIHono10().use("*", (c, next) => {
+  hasPermissionThrow(c, IAM_ALL5);
+  return next();
+});
+var sessionRoutes = sessionRoutesBase.openapi(listSessionsRoute, listSessionsHandler).openapi(getSessionRoute, getSessionHandler).openapi(revokeSessionRoute, revokeSessionHandler).openapi(revokeAllSessionsRoute, revokeAllSessionsHandler);
 var sessions_route_default = sessionRoutes;
 
 // src/routes/system/system.route.ts
@@ -6277,6 +6326,7 @@ var tenantHandler = (c) => {
 };
 
 // src/routes/system/system.route.ts
+var IAM_ALL6 = "iam:all:all";
 var tenantRoute = createRoute11({
   method: "get",
   path: "/init",
@@ -6311,10 +6361,11 @@ var tenantRoute = createRoute11({
     }
   }
 });
-var tenantRoutes = new OpenAPIHono11().openapi(
-  tenantRoute,
-  tenantHandler
-);
+var tenantRoutesBase = new OpenAPIHono11().use("*", (c, next) => {
+  hasPermissionThrow(c, IAM_ALL6);
+  return next();
+});
+var tenantRoutes = tenantRoutesBase.openapi(tenantRoute, tenantHandler);
 var system_route_default = tenantRoutes;
 
 // src/routes/tenants/tenants.route.ts
@@ -6322,42 +6373,7 @@ import { createRoute as createRoute12, OpenAPIHono as OpenAPIHono12 } from "@hon
 
 // src/routes/tenants/handler/create-tenant.ts
 import { eq as eq48 } from "drizzle-orm";
-
-// src/lib/has-role-permission.ts
-import { grant } from "@mesob/common";
-import { HTTPException as HTTPException4 } from "hono/http-exception";
-var toArray = (v) => {
-  return Array.isArray(v) ? v : [v];
-};
-var hasRole = (c, role) => {
-  const user = c.get("user");
-  const codes = user?.roleCodes;
-  if (!codes?.length) {
-    return false;
-  }
-  const check2 = toArray(role);
-  return check2.some((r) => codes.includes(r));
-};
-var hasRoleThrow = (c, role) => {
-  if (!hasRole(c, role)) {
-    throw new HTTPException4(401, { message: "Unauthorized" });
-  }
-};
-var hasPermission = (c, permission) => {
-  const user = c.get("user");
-  const perms = user?.permissions;
-  const check2 = toArray(permission);
-  return grant(check2, perms);
-};
-var hasPermissionThrow = (c, permission) => {
-  if (!hasPermission(c, permission)) {
-    throw new HTTPException4(401, { message: "Unauthorized" });
-  }
-};
-
-// src/routes/tenants/handler/create-tenant.ts
 var createTenantHandler = async (c) => {
-  hasRoleThrow(c, ["owner", "tenant-admin"]);
   const body = c.req.valid("json");
   const database = c.get("database");
   const [existing] = await database.select().from(tenantsInIam).where(eq48(tenantsInIam.id, body.id)).limit(1);
@@ -6385,7 +6401,6 @@ var createTenantHandler = async (c) => {
 // src/routes/tenants/handler/delete-tenant.ts
 import { eq as eq49 } from "drizzle-orm";
 var deleteTenantHandler = async (c) => {
-  hasRoleThrow(c, ["owner", "tenant-admin"]);
   const { id } = c.req.valid("param");
   const database = c.get("database");
   const [existing] = await database.select().from(tenantsInIam).where(eq49(tenantsInIam.id, id)).limit(1);
@@ -6399,7 +6414,6 @@ var deleteTenantHandler = async (c) => {
 // src/routes/tenants/handler/get-tenant.ts
 import { eq as eq50 } from "drizzle-orm";
 var getTenantHandler = async (c) => {
-  hasRoleThrow(c, ["owner", "tenant-admin"]);
   const { id } = c.req.valid("param");
   const database = c.get("database");
   const [tenant] = await database.select().from(tenantsInIam).where(eq50(tenantsInIam.id, id)).limit(1);
@@ -6417,7 +6431,6 @@ var sortColumnMap3 = {
   name: sql23`${tenantsInIam.name}::text`
 };
 var listTenantsHandler = async (c) => {
-  hasRoleThrow(c, ["owner", "tenant-admin"]);
   const query = c.req.valid("query");
   const database = c.get("database");
   const page = query.page || 1;
@@ -6456,7 +6469,6 @@ var listTenantsHandler = async (c) => {
 // src/routes/tenants/handler/update-tenant.ts
 import { eq as eq52, sql as sql24 } from "drizzle-orm";
 var updateTenantHandler = async (c) => {
-  hasRoleThrow(c, ["owner", "tenant-admin"]);
   const { id } = c.req.valid("param");
   const body = c.req.valid("json");
   const database = c.get("database");
@@ -6730,7 +6742,12 @@ var deleteTenantRoute = createRoute12({
     }
   }
 });
-var tenantRoutes2 = new OpenAPIHono12().openapi(listTenantsRoute, listTenantsHandler).openapi(getTenantRoute, getTenantHandler).openapi(createTenantRoute, createTenantHandler).openapi(updateTenantRoute, updateTenantHandler).openapi(deleteTenantRoute, deleteTenantHandler);
+var IAM_ALL7 = "iam:all:all";
+var tenantRoutesBase2 = new OpenAPIHono12().use("*", (c, next) => {
+  hasPermissionThrow(c, IAM_ALL7);
+  return next();
+});
+var tenantRoutes2 = tenantRoutesBase2.openapi(listTenantsRoute, listTenantsHandler).openapi(getTenantRoute, getTenantHandler).openapi(createTenantRoute, createTenantHandler).openapi(updateTenantRoute, updateTenantHandler).openapi(deleteTenantRoute, deleteTenantHandler);
 var tenants_route_default = tenantRoutes2;
 
 // src/routes/user-roles/user-roles.route.ts
@@ -6905,7 +6922,12 @@ var revokeUserRoleRoute = createRoute13({
     }
   }
 });
-var userRoleRoutes = new OpenAPIHono13().openapi(listUserRolesRoute, listUserRolesHandler).openapi(assignUserRoleRoute, assignUserRoleHandler).openapi(revokeUserRoleRoute, revokeUserRoleHandler);
+var IAM_ALL8 = "iam:all:all";
+var userRoleRoutesBase = new OpenAPIHono13().use("*", (c, next) => {
+  hasPermissionThrow(c, IAM_ALL8);
+  return next();
+});
+var userRoleRoutes = userRoleRoutesBase.openapi(listUserRolesRoute, listUserRolesHandler).openapi(assignUserRoleRoute, assignUserRoleHandler).openapi(revokeUserRoleRoute, revokeUserRoleHandler);
 var user_roles_route_default = userRoleRoutes;
 
 // src/routes/users/users.route.ts
@@ -6922,25 +6944,19 @@ var banUserHandler = async (c) => {
   if (!existing) {
     return c.json({ error: "User not found" }, 404);
   }
-  const [updated] = await database.update(usersInIam).set({
-    bannedUntil: body.bannedUntil || null,
+  await database.update(usersInIam).set({
+    bannedUntil: body.bannedUntil ?? null,
     updatedAt: sql25`CURRENT_TIMESTAMP`
-  }).where(and50(eq55(usersInIam.id, id), eq55(usersInIam.tenantId, tenantId))).returning({
-    id: usersInIam.id,
-    tenantId: usersInIam.tenantId,
-    fullName: usersInIam.fullName,
-    email: usersInIam.email,
-    phone: usersInIam.phone,
-    handle: usersInIam.handle,
-    image: usersInIam.image,
-    emailVerified: usersInIam.emailVerified,
-    phoneVerified: usersInIam.phoneVerified,
-    lastSignInAt: usersInIam.lastSignInAt
+  }).where(and50(eq55(usersInIam.id, id), eq55(usersInIam.tenantId, tenantId)));
+  const userWithRoles = await fetchUserWithRoles({
+    database,
+    userId: id,
+    tenantId
   });
-  if (!updated) {
+  if (!userWithRoles) {
     return c.json({ error: "User not found" }, 404);
   }
-  return c.json({ user: normalizeUser(updated) }, 200);
+  return c.json({ user: normalizeUser(userWithRoles) }, 200);
 };
 
 // src/routes/users/helper/user.ts
@@ -7250,7 +7266,7 @@ var inviteUserHandler = async (c) => {
 };
 
 // src/routes/users/handler/list-users.ts
-import { and as and53, asc as asc5, desc as desc5, eq as eq58, ilike as ilike4, inArray as inArray6, or as or4, sql as sql27 } from "drizzle-orm";
+import { and as and53, asc as asc5, desc as desc5, eq as eq58, gt as gt8, ilike as ilike4, inArray as inArray6, or as or4, sql as sql27 } from "drizzle-orm";
 var userSelect = {
   id: usersInIam.id,
   tenantId: usersInIam.tenantId,
@@ -7266,9 +7282,6 @@ var userSelect = {
   userType: usersInIam.userType,
   roleCount: sql27`(select count(*)::int from ${userRolesInIam} where ${userRolesInIam.userId} = ${usersInIam.id} and ${userRolesInIam.tenantId} = ${usersInIam.tenantId})`.as(
     "roleCount"
-  ),
-  activeSessionCount: sql27`(select count(*)::int from ${sessionsInIam} where ${sessionsInIam.userId} = ${usersInIam.id} and ${sessionsInIam.tenantId} = ${usersInIam.tenantId} and ${sessionsInIam.expiresAt} > now())`.as(
-    "activeSessionCount"
   )
 };
 var sortColumnMap4 = {
@@ -7301,11 +7314,11 @@ var listUsersHandler = async (c) => {
   const query = c.req.valid("query");
   const database = c.get("database");
   const tenantId = c.get("tenantId");
-  const config = c.get("config");
+  const _config = c.get("config");
   const page = query.page || 1;
   const limit = query.limit || 20;
   const offset = (page - 1) * limit;
-  const userTypeFilter = (query.userType && query.userType !== "all" ? query.userType : null) ?? config.userType;
+  const userTypeFilter = query.userType && query.userType !== "all" ? query.userType : null;
   const conditions = [eq58(usersInIam.tenantId, tenantId)];
   if (userTypeFilter) {
     conditions.push(
@@ -7313,14 +7326,15 @@ var listUsersHandler = async (c) => {
     );
   }
   if (query.search?.trim()) {
-    const term = `%${query.search.trim().replace(/[%_\\]/g, (c2) => `\\${c2}`)}%`;
-    conditions.push(
-      or4(
-        ilike4(usersInIam.fullName, term),
-        ilike4(usersInIam.email, term),
-        ilike4(usersInIam.phone, term)
-      )
+    const term = `%${query.search.trim().replace(/[%_\\]/g, (ch) => `\\${ch}`)}%`;
+    const searchCond = or4(
+      ilike4(usersInIam.fullName, term),
+      ilike4(usersInIam.email, term),
+      ilike4(usersInIam.phone, term)
     );
+    if (searchCond) {
+      conditions.push(searchCond);
+    }
   }
   if (query.email) {
     conditions.push(ilike4(usersInIam.email, `%${query.email}%`));
@@ -7332,12 +7346,13 @@ var listUsersHandler = async (c) => {
     conditions.push(ilike4(usersInIam.handle, `%${query.handle}%`));
   }
   if (query.filter === "verified") {
-    conditions.push(
-      or4(
-        eq58(usersInIam.emailVerified, true),
-        eq58(usersInIam.phoneVerified, true)
-      )
+    const verifiedCond = or4(
+      eq58(usersInIam.emailVerified, true),
+      eq58(usersInIam.phoneVerified, true)
     );
+    if (verifiedCond) {
+      conditions.push(verifiedCond);
+    }
   } else if (query.filter === "unverified") {
     conditions.push(eq58(usersInIam.emailVerified, false));
     conditions.push(eq58(usersInIam.phoneVerified, false));
@@ -7351,6 +7366,19 @@ var listUsersHandler = async (c) => {
   ]);
   const total = Number(totalResult[0]?.count || 0);
   const userIds = users.map((u) => u.id);
+  const sessionCountRows = userIds.length > 0 ? await database.select({
+    userId: sessionsInIam.userId,
+    count: sql27`count(*)::int`.as("count")
+  }).from(sessionsInIam).where(
+    and53(
+      eq58(sessionsInIam.tenantId, tenantId),
+      inArray6(sessionsInIam.userId, userIds),
+      gt8(sessionsInIam.expiresAt, (/* @__PURE__ */ new Date()).toISOString())
+    )
+  ).groupBy(sessionsInIam.userId) : [];
+  const sessionCountByUser = new Map(
+    sessionCountRows.map((r) => [r.userId, Number(r.count) ?? 0])
+  );
   const roleRows = userIds.length > 0 ? await database.select({
     userId: userRolesInIam.userId,
     code: rolesInIam.code,
@@ -7382,7 +7410,7 @@ var listUsersHandler = async (c) => {
         ...u,
         roles: null,
         userRoles: userRolesMap.get(u.id) ?? [],
-        activeSessionCount: Number(u.activeSessionCount) ?? 0
+        activeSessionCount: sessionCountByUser.get(u.id) ?? 0
       })),
       total,
       page,
@@ -7917,7 +7945,12 @@ var bulkInviteUsersRoute = createRoute14({
     }
   }
 });
-var userRoutes = new OpenAPIHono14().openapi(listUsersRoute, listUsersHandler).openapi(getUserRoute, getUserHandler).openapi(createUserRoute, createUserHandler).openapi(updateUserRoute, updateUserHandler).openapi(deleteUserRoute, deleteUserHandler).openapi(banUserRoute, banUserHandler).openapi(searchUsersRoute, searchUsersHandler).openapi(inviteUserRoute, inviteUserHandler).openapi(bulkInviteUsersRoute, bulkInviteUsersHandler);
+var IAM_ALL9 = "iam:all:all";
+var userRoutesBase = new OpenAPIHono14().use("*", (c, next) => {
+  hasPermissionThrow(c, IAM_ALL9);
+  return next();
+});
+var userRoutes = userRoutesBase.openapi(listUsersRoute, listUsersHandler).openapi(getUserRoute, getUserHandler).openapi(createUserRoute, createUserHandler).openapi(updateUserRoute, updateUserHandler).openapi(deleteUserRoute, deleteUserHandler).openapi(banUserRoute, banUserHandler).openapi(searchUsersRoute, searchUsersHandler).openapi(inviteUserRoute, inviteUserHandler).openapi(bulkInviteUsersRoute, bulkInviteUsersHandler);
 var users_route_default = userRoutes;
 
 // src/routes/verifications/verifications.route.ts
@@ -8558,8 +8591,6 @@ export {
   createSessionMiddleware,
   createTenantMiddleware,
   hasPermission,
-  hasPermissionThrow,
-  hasRole,
-  hasRoleThrow
+  hasPermissionThrow
 };
 //# sourceMappingURL=index.js.map