@nestjs-kit/better-auth 0.0.0-stage → 2.1.0

package/dist/microservices.mjs

@@ -0,0 +1,222 @@
+import { n as BetterAuthConfigurationError, t as AuthFailures } from "./auth-errors-C3rbTV9p.mjs";
+import { Logger } from "@nestjs/common";
+import { MetadataScanner } from "@nestjs/core";
+import * as microservices from "@nestjs/microservices";
+import { MessagePattern, RpcException } from "@nestjs/microservices";
+//#region src/rpc-carriers.ts
+const credentialNames = [
+	"authorization",
+	"cookie",
+	"x-api-key"
+];
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function method(value, name) {
+	const candidate = record(value)?.[name];
+	return typeof candidate === "function" ? candidate.bind(value) : void 0;
+}
+function contextOf(context) {
+	return context.switchToRpc().getContext();
+}
+function extract(input, allow) {
+	const headers = new Headers();
+	const allowed = new Set(allow.map((name) => name.toLowerCase()));
+	for (const name of [
+		"host",
+		"x-forwarded-host",
+		"x-forwarded-proto",
+		"set-cookie"
+	]) allowed.delete(name);
+	const source = record(input);
+	if (!source) return headers;
+	for (const name of Object.keys(source)) {
+		const normalized = name.toLowerCase();
+		if (!allowed.has(normalized)) continue;
+		const value = source[name];
+		const values = Array.isArray(value) ? value : [value];
+		if (values.length === 0) throw AuthFailures.rejected({
+			status: 401,
+			reason: "MALFORMED_CREDENTIALS"
+		});
+		for (const item of values) {
+			const text = typeof item === "string" ? item : Buffer.isBuffer(item) ? item.toString("utf8") : void 0;
+			if (text === void 0 || /[\r\n\0]/.test(text)) throw AuthFailures.rejected({
+				status: 401,
+				reason: "MALFORMED_CREDENTIALS"
+			});
+			try {
+				headers.append(normalized, text);
+			} catch {
+				throw AuthFailures.rejected({
+					status: 401,
+					reason: "MALFORMED_CREDENTIALS"
+				});
+			}
+		}
+	}
+	return headers;
+}
+function grpcCarrier(options = {}) {
+	return {
+		id: "grpc",
+		matches: (context) => !!method(context.getArgByIndex(1), "get") && !!method(context.getArgByIndex(1), "getMap"),
+		headers: (context) => extract(method(context.getArgByIndex(1), "getMap")?.(), options.metadata ?? credentialNames),
+		toException(failure) {
+			const name = failure.status === 401 ? "GrpcUnauthenticatedException" : failure.status === 403 ? "GrpcPermissionDeniedException" : "GrpcResourceExhaustedException";
+			const Native = microservices[name];
+			return new microservices.RpcException(Native ? new Native(failure.message).getError() : {
+				code: failure.status === 401 ? 16 : failure.status === 403 ? 7 : 8,
+				message: failure.message
+			});
+		}
+	};
+}
+function natsCarrier(options = {}) {
+	return {
+		id: "nats",
+		matches: (context) => !!method(contextOf(context), "getHeaders"),
+		headers(context) {
+			const input = method(contextOf(context), "getHeaders")?.();
+			const keys = method(input, "keys")?.();
+			const get = method(input, "get");
+			const values = Object.create(null);
+			if (Array.isArray(keys) && get) {
+				for (const key of keys) if (typeof key === "string") values[key] = get(key);
+			}
+			return extract(values, options.headers ?? credentialNames);
+		}
+	};
+}
+function kafkaCarrier(options = {}) {
+	const message = (context) => record(method(contextOf(context), "getMessage")?.());
+	return {
+		id: "kafka",
+		matches: (context) => message(context) !== void 0 && "headers" in message(context),
+		headers: (context) => extract(message(context)?.headers, options.headers ?? credentialNames)
+	};
+}
+function rmqCarrier(options = {}) {
+	const message = (context) => record(method(contextOf(context), "getMessage")?.());
+	return {
+		id: "rmq",
+		matches: (context) => message(context) !== void 0 && "properties" in message(context),
+		headers: (context) => extract(record(message(context)?.properties)?.headers, options.headers ?? credentialNames)
+	};
+}
+function mqttCarrier(options = {}) {
+	return {
+		id: "mqtt",
+		matches: (context) => !!method(contextOf(context), "getPacket"),
+		headers: (context) => extract(record(record(method(contextOf(context), "getPacket")?.())?.properties)?.userProperties, options.userProperties ?? credentialNames)
+	};
+}
+function payloadCarrier(options = {}) {
+	const payload = (context) => {
+		const data = record(context.switchToRpc().getData());
+		const field = options.field ?? "auth";
+		return data && Object.hasOwn(data, field) ? record(data[field]) : void 0;
+	};
+	return {
+		id: "payload",
+		matches: (context) => payload(context) !== void 0,
+		headers: (context) => extract(payload(context), credentialNames)
+	};
+}
+const defaultCarriers = Object.freeze([
+	grpcCarrier(),
+	natsCarrier(),
+	kafkaCarrier(),
+	rmqCarrier(),
+	mqttCarrier(),
+	payloadCarrier()
+]);
+//#endregion
+//#region src/rpc-transport.ts
+function rpcTransport(options = {}) {
+	const carriers = [...options.carriers ?? defaultCarriers];
+	const select = (context) => carriers.find((carrier) => carrier.matches(context));
+	const grpc = grpcCarrier();
+	return {
+		id: "rpc",
+		requires: { hostlessCalls: true },
+		handles: (context) => context.getType() === "rpc",
+		describe(context) {
+			const candidate = context.switchToRpc().getContext();
+			const key = candidate !== null && typeof candidate === "object" ? candidate : context.getArgs();
+			return {
+				key,
+				invocation: key,
+				cookies: null,
+				clientIp: null,
+				headers() {
+					const input = select(context)?.headers(context);
+					try {
+						return new Headers(input);
+					} catch {
+						throw AuthFailures.rejected({
+							status: 401,
+							reason: "MALFORMED_CREDENTIALS"
+						});
+					}
+				},
+				param(name) {
+					const data = context.switchToRpc().getData();
+					return data !== null && typeof data === "object" && Object.hasOwn(data, name) ? data[name] : void 0;
+				}
+			};
+		},
+		toException(failure, context) {
+			const carrier = select(context);
+			return carrier?.toException ? carrier.toException(failure, context) : new RpcException({
+				status: "error",
+				statusCode: failure.status,
+				code: failure.code,
+				...failure.reason ? { reason: failure.reason } : {},
+				message: failure.message
+			});
+		},
+		toInternalException(error, context, info) {
+			if (!grpc.matches(context)) return error;
+			if (!info.repeated) new Logger("BetterAuthRpc").error(error);
+			return new RpcException({
+				code: 13,
+				message: "Internal server error"
+			});
+		},
+		validate(context) {
+			class Probe {
+				handler() {}
+			}
+			MessagePattern("nestjs-kit-better-auth-probe")(Probe.prototype, "handler", Object.getOwnPropertyDescriptor(Probe.prototype, "handler"));
+			const patterns = Reflect.getMetadata("microservices:pattern", Probe.prototype.handler);
+			if (!Array.isArray(patterns) || patterns[0] !== "nestjs-kit-better-auth-probe") throw new BetterAuthConfigurationError("NEST_METADATA_KEY_CHANGED", "Nest RPC pattern metadata failed its canary");
+			const explicit = context.hasHttpAdapter && !options.inheritAppConfig;
+			const scanner = new MetadataScanner();
+			for (const wrapper of context.discovery.getControllers()) {
+				const target = wrapper.metatype;
+				if (!target?.prototype || wrapper.isAlias) continue;
+				for (const name of scanner.getAllMethodNames(target.prototype)) {
+					if (Reflect.getMetadata("microservices:pattern", target.prototype[name]) === void 0) continue;
+					context.claim(target, name, explicit ? "explicit" : "global", {
+						code: "RPC_HANDLER_UNGUARDED",
+						everyHandler: explicit,
+						coverage: explicit ? options.hybridCoverage ?? "error" : "error",
+						hint: "Add @UseBetterAuth() or @Public() to the RPC controller/handler, or assert inheritAppConfig and pass { inheritAppConfig: true } to every connectMicroservice call."
+					});
+				}
+			}
+		},
+		advise() {
+			return options.inheritAppConfig ? [{
+				level: "warn",
+				code: "W_RPC_INHERIT_APP_CONFIG_ASSERTED",
+				message: "RPC coverage assumes every connectMicroservice() call passes { inheritAppConfig: true }. Prefer @UseBetterAuth() on message controllers for verifiable coverage."
+			}] : [];
+		}
+	};
+}
+//#endregion
+export { defaultCarriers, grpcCarrier, kafkaCarrier, mqttCarrier, natsCarrier, payloadCarrier, rmqCarrier, rpcTransport };
+
+//# sourceMappingURL=microservices.mjs.map

package/dist/microservices.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"microservices.mjs","names":[],"sources":["../src/rpc-carriers.ts","../src/rpc-transport.ts"],"sourcesContent":["import type { ExecutionContext } from \"@nestjs/common\";\nimport * as microservices from \"@nestjs/microservices\";\nimport { AuthFailures, type AuthFailure } from \"./auth-errors.js\";\n\nexport interface RpcCredentialCarrier {\n  readonly id: string;\n  matches(context: ExecutionContext): boolean;\n  headers(context: ExecutionContext): HeadersInit | undefined;\n  toException?(failure: AuthFailure, context: ExecutionContext): unknown;\n}\n\nconst credentialNames = [\"authorization\", \"cookie\", \"x-api-key\"] as const;\n\ntype RecordValue = Record<string, unknown>;\nfunction record(value: unknown): RecordValue | undefined {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as RecordValue)\n    : undefined;\n}\nfunction method(\n  value: unknown,\n  name: string,\n): ((...args: unknown[]) => unknown) | undefined {\n  const target = record(value);\n  const candidate = target?.[name];\n  return typeof candidate === \"function\" ? candidate.bind(value) : undefined;\n}\nfunction contextOf(context: ExecutionContext): unknown {\n  return context.switchToRpc().getContext<unknown>();\n}\nfunction extract(input: unknown, allow: readonly string[]): Headers {\n  const headers = new Headers();\n  const allowed = new Set(allow.map((name) => name.toLowerCase()));\n  // Host and forwarding metadata must never influence hostless authentication.\n  for (const name of [\n    \"host\",\n    \"x-forwarded-host\",\n    \"x-forwarded-proto\",\n    \"set-cookie\",\n  ]) {\n    allowed.delete(name);\n  }\n  const source = record(input);\n  if (!source) {\n    return headers;\n  }\n  for (const name of Object.keys(source)) {\n    const normalized = name.toLowerCase();\n    if (!allowed.has(normalized)) {\n      continue;\n    }\n    const value = source[name];\n    const values = Array.isArray(value) ? value : [value];\n    if (values.length === 0) {\n      throw AuthFailures.rejected({\n        status: 401,\n        reason: \"MALFORMED_CREDENTIALS\",\n      });\n    }\n    for (const item of values) {\n      const text =\n        typeof item === \"string\"\n          ? item\n          : Buffer.isBuffer(item)\n            ? item.toString(\"utf8\")\n            : undefined;\n      if (text === undefined || /[\\r\\n\\0]/.test(text)) {\n        throw AuthFailures.rejected({\n          status: 401,\n          reason: \"MALFORMED_CREDENTIALS\",\n        });\n      }\n      try {\n        headers.append(normalized, text);\n      } catch {\n        // Web Headers errors can embed credentials in their message. Never retain\n        // that error, and never discard one bad credential to try another one.\n        throw AuthFailures.rejected({\n          status: 401,\n          reason: \"MALFORMED_CREDENTIALS\",\n        });\n      }\n    }\n  }\n  return headers;\n}\n\nexport function grpcCarrier(\n  options: { metadata?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  return {\n    id: \"grpc\",\n    matches: (context) =>\n      !!method(context.getArgByIndex(1), \"get\") &&\n      !!method(context.getArgByIndex(1), \"getMap\"),\n    headers: (context) =>\n      extract(\n        method(context.getArgByIndex(1), \"getMap\")?.(),\n        options.metadata ?? credentialNames,\n      ),\n    toException(failure) {\n      const name =\n        failure.status === 401\n          ? \"GrpcUnauthenticatedException\"\n          : failure.status === 403\n            ? \"GrpcPermissionDeniedException\"\n            : \"GrpcResourceExhaustedException\";\n      const Native = (\n        microservices as unknown as Record<\n          string,\n          new (\n            message: string,\n          ) => Error & { getError(): object }\n        >\n      )[name];\n      // Native gRPC exceptions require an opt-in Nest filter. Wrap their payload\n      // so the default RPC filter also delivers the numeric status.\n      return new microservices.RpcException(\n        Native\n          ? new Native(failure.message).getError()\n          : {\n              code:\n                failure.status === 401 ? 16 : failure.status === 403 ? 7 : 8,\n              message: failure.message,\n            },\n      );\n    },\n  };\n}\n\nexport function natsCarrier(\n  options: { headers?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  return {\n    id: \"nats\",\n    matches: (context) => !!method(contextOf(context), \"getHeaders\"),\n    headers(context) {\n      const input = method(contextOf(context), \"getHeaders\")?.();\n      const keys = method(input, \"keys\")?.();\n      const get = method(input, \"get\");\n      const values: RecordValue = Object.create(null);\n      if (Array.isArray(keys) && get) {\n        for (const key of keys) {\n          if (typeof key === \"string\") {\n            values[key] = get(key);\n          }\n        }\n      }\n      return extract(values, options.headers ?? credentialNames);\n    },\n  };\n}\n\nexport function kafkaCarrier(\n  options: { headers?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  const message = (context: ExecutionContext) =>\n    record(method(contextOf(context), \"getMessage\")?.());\n  return {\n    id: \"kafka\",\n    matches: (context) =>\n      message(context) !== undefined && \"headers\" in message(context)!,\n    headers: (context) =>\n      extract(message(context)?.headers, options.headers ?? credentialNames),\n  };\n}\n\nexport function rmqCarrier(\n  options: { headers?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  const message = (context: ExecutionContext) =>\n    record(method(contextOf(context), \"getMessage\")?.());\n  return {\n    id: \"rmq\",\n    matches: (context) =>\n      message(context) !== undefined && \"properties\" in message(context)!,\n    headers: (context) =>\n      extract(\n        record(message(context)?.properties)?.headers,\n        options.headers ?? credentialNames,\n      ),\n  };\n}\n\nexport function mqttCarrier(\n  options: { userProperties?: readonly string[] } = {},\n): RpcCredentialCarrier {\n  return {\n    id: \"mqtt\",\n    matches: (context) => !!method(contextOf(context), \"getPacket\"),\n    headers: (context) =>\n      extract(\n        record(record(method(contextOf(context), \"getPacket\")?.())?.properties)\n          ?.userProperties,\n        options.userProperties ?? credentialNames,\n      ),\n  };\n}\n\nexport function payloadCarrier(\n  options: { field?: string } = {},\n): RpcCredentialCarrier {\n  const payload = (context: ExecutionContext) => {\n    const data = record(context.switchToRpc().getData<unknown>());\n    const field = options.field ?? \"auth\";\n    return data && Object.hasOwn(data, field) ? record(data[field]) : undefined;\n  };\n  return {\n    id: \"payload\",\n    matches: (context) => payload(context) !== undefined,\n    headers: (context) => extract(payload(context), credentialNames),\n  };\n}\n\nexport const defaultCarriers: readonly RpcCredentialCarrier[] = Object.freeze([\n  grpcCarrier(),\n  natsCarrier(),\n  kafkaCarrier(),\n  rmqCarrier(),\n  mqttCarrier(),\n  payloadCarrier(),\n]);\n","import { Logger, type ExecutionContext } from \"@nestjs/common\";\nimport { MetadataScanner } from \"@nestjs/core\";\nimport { MessagePattern, RpcException } from \"@nestjs/microservices\";\nimport type {\n  AuthTransport,\n  BootAdvice,\n  ExtensionRef,\n  TransportCall,\n  TransportValidationContext,\n} from \"./auth-contracts.js\";\nimport {\n  BetterAuthConfigurationError,\n  AuthFailures,\n  type AuthFailure,\n} from \"./auth-errors.js\";\nimport {\n  defaultCarriers,\n  grpcCarrier,\n  type RpcCredentialCarrier,\n} from \"./rpc-carriers.js\";\n\nexport interface RpcTransportOptions {\n  carriers?: readonly RpcCredentialCarrier[];\n  hybridCoverage?: \"error\" | \"warn\" | \"off\";\n  inheritAppConfig?: boolean;\n}\n\nexport function rpcTransport(\n  options: RpcTransportOptions = {},\n): ExtensionRef<AuthTransport> {\n  const carriers = [...(options.carriers ?? defaultCarriers)];\n  const select = (context: ExecutionContext) =>\n    carriers.find((carrier) => carrier.matches(context));\n  const grpc = grpcCarrier();\n  return {\n    id: \"rpc\",\n    requires: { hostlessCalls: true },\n    handles: (context) => context.getType() === \"rpc\",\n    describe(context): TransportCall {\n      const candidate = context.switchToRpc().getContext<unknown>();\n      const key =\n        candidate !== null && typeof candidate === \"object\"\n          ? candidate\n          : context.getArgs();\n      return {\n        key,\n        invocation: key,\n        cookies: null,\n        clientIp: null,\n        headers() {\n          const input = select(context)?.headers(context);\n          try {\n            return new Headers(input);\n          } catch {\n            // Custom carriers may return a raw HeadersInit. Conversion errors\n            // include its values, so discard the original error and its cause.\n            throw AuthFailures.rejected({\n              status: 401,\n              reason: \"MALFORMED_CREDENTIALS\",\n            });\n          }\n        },\n        param(name) {\n          const data = context.switchToRpc().getData<unknown>();\n          return data !== null &&\n            typeof data === \"object\" &&\n            Object.hasOwn(data, name)\n            ? (data as Record<string, unknown>)[name]\n            : undefined;\n        },\n      };\n    },\n    toException(failure: AuthFailure, context) {\n      const carrier = select(context);\n      return carrier?.toException\n        ? carrier.toException(failure, context)\n        : new RpcException({\n            status: \"error\",\n            statusCode: failure.status,\n            code: failure.code,\n            ...(failure.reason ? { reason: failure.reason } : {}),\n            message: failure.message,\n          });\n    },\n    toInternalException(error, context, info) {\n      if (!grpc.matches(context)) {\n        return error;\n      }\n      if (!info.repeated) {\n        new Logger(\"BetterAuthRpc\").error(error);\n      }\n      return new RpcException({ code: 13, message: \"Internal server error\" });\n    },\n    validate(context: TransportValidationContext) {\n      class Probe {\n        handler(): void {}\n      }\n      MessagePattern(\"nestjs-kit-better-auth-probe\")(\n        Probe.prototype,\n        \"handler\",\n        Object.getOwnPropertyDescriptor(Probe.prototype, \"handler\")!,\n      );\n      const patterns: unknown = Reflect.getMetadata(\n        \"microservices:pattern\",\n        Probe.prototype.handler,\n      );\n      if (\n        !Array.isArray(patterns) ||\n        patterns[0] !== \"nestjs-kit-better-auth-probe\"\n      ) {\n        throw new BetterAuthConfigurationError(\n          \"NEST_METADATA_KEY_CHANGED\",\n          \"Nest RPC pattern metadata failed its canary\",\n        );\n      }\n      const explicit = context.hasHttpAdapter && !options.inheritAppConfig;\n      const scanner = new MetadataScanner();\n      for (const wrapper of context.discovery.getControllers()) {\n        const target = wrapper.metatype;\n        if (!target?.prototype || wrapper.isAlias) {\n          continue;\n        }\n        for (const name of scanner.getAllMethodNames(target.prototype)) {\n          if (\n            Reflect.getMetadata(\n              \"microservices:pattern\",\n              target.prototype[name],\n            ) === undefined\n          ) {\n            continue;\n          }\n          context.claim(target, name, explicit ? \"explicit\" : \"global\", {\n            code: \"RPC_HANDLER_UNGUARDED\",\n            everyHandler: explicit,\n            coverage: explicit ? (options.hybridCoverage ?? \"error\") : \"error\",\n            hint: \"Add @UseBetterAuth() or @Public() to the RPC controller/handler, or assert inheritAppConfig and pass { inheritAppConfig: true } to every connectMicroservice call.\",\n          });\n        }\n      }\n    },\n    advise(): readonly BootAdvice[] {\n      return options.inheritAppConfig\n        ? [\n            {\n              level: \"warn\",\n              code: \"W_RPC_INHERIT_APP_CONFIG_ASSERTED\",\n              message:\n                \"RPC coverage assumes every connectMicroservice() call passes { inheritAppConfig: true }. Prefer @UseBetterAuth() on message controllers for verifiable coverage.\",\n            },\n          ]\n        : [];\n    },\n  } satisfies AuthTransport;\n}\n"],"mappings":";;;;;;AAWA,MAAM,kBAAkB;CAAC;CAAiB;CAAU;AAAW;AAG/D,SAAS,OAAO,OAAyC;CACvD,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD,KAAA;AACN;AACA,SAAS,OACP,OACA,MAC+C;CAE/C,MAAM,YADS,OAAO,KACC,CAAC,GAAG;CAC3B,OAAO,OAAO,cAAc,aAAa,UAAU,KAAK,KAAK,IAAI,KAAA;AACnE;AACA,SAAS,UAAU,SAAoC;CACrD,OAAO,QAAQ,YAAY,CAAC,CAAC,WAAoB;AACnD;AACA,SAAS,QAAQ,OAAgB,OAAmC;CAClE,MAAM,UAAU,IAAI,QAAQ;CAC5B,MAAM,UAAU,IAAI,IAAI,MAAM,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC;CAE/D,KAAK,MAAM,QAAQ;EACjB;EACA;EACA;EACA;CACF,GACE,QAAQ,OAAO,IAAI;CAErB,MAAM,SAAS,OAAO,KAAK;CAC3B,IAAI,CAAC,QACH,OAAO;CAET,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,GAAG;EACtC,MAAM,aAAa,KAAK,YAAY;EACpC,IAAI,CAAC,QAAQ,IAAI,UAAU,GACzB;EAEF,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;EACpD,IAAI,OAAO,WAAW,GACpB,MAAM,aAAa,SAAS;GAC1B,QAAQ;GACR,QAAQ;EACV,CAAC;EAEH,KAAK,MAAM,QAAQ,QAAQ;GACzB,MAAM,OACJ,OAAO,SAAS,WACZ,OACA,OAAO,SAAS,IAAI,IAClB,KAAK,SAAS,MAAM,IACpB,KAAA;GACR,IAAI,SAAS,KAAA,KAAa,WAAW,KAAK,IAAI,GAC5C,MAAM,aAAa,SAAS;IAC1B,QAAQ;IACR,QAAQ;GACV,CAAC;GAEH,IAAI;IACF,QAAQ,OAAO,YAAY,IAAI;GACjC,QAAQ;IAGN,MAAM,aAAa,SAAS;KAC1B,QAAQ;KACR,QAAQ;IACV,CAAC;GACH;EACF;CACF;CACA,OAAO;AACT;AAEA,SAAgB,YACd,UAA4C,CAAC,GACvB;CACtB,OAAO;EACL,IAAI;EACJ,UAAU,YACR,CAAC,CAAC,OAAO,QAAQ,cAAc,CAAC,GAAG,KAAK,KACxC,CAAC,CAAC,OAAO,QAAQ,cAAc,CAAC,GAAG,QAAQ;EAC7C,UAAU,YACR,QACE,OAAO,QAAQ,cAAc,CAAC,GAAG,QAAQ,CAAC,GAAG,GAC7C,QAAQ,YAAY,eACtB;EACF,YAAY,SAAS;GACnB,MAAM,OACJ,QAAQ,WAAW,MACf,iCACA,QAAQ,WAAW,MACjB,kCACA;GACR,MAAM,SACJ,cAMA;GAGF,OAAO,IAAI,cAAc,aACvB,SACI,IAAI,OAAO,QAAQ,OAAO,CAAC,CAAC,SAAS,IACrC;IACE,MACE,QAAQ,WAAW,MAAM,KAAK,QAAQ,WAAW,MAAM,IAAI;IAC7D,SAAS,QAAQ;GACnB,CACN;EACF;CACF;AACF;AAEA,SAAgB,YACd,UAA2C,CAAC,GACtB;CACtB,OAAO;EACL,IAAI;EACJ,UAAU,YAAY,CAAC,CAAC,OAAO,UAAU,OAAO,GAAG,YAAY;EAC/D,QAAQ,SAAS;GACf,MAAM,QAAQ,OAAO,UAAU,OAAO,GAAG,YAAY,CAAC,GAAG;GACzD,MAAM,OAAO,OAAO,OAAO,MAAM,CAAC,GAAG;GACrC,MAAM,MAAM,OAAO,OAAO,KAAK;GAC/B,MAAM,SAAsB,OAAO,OAAO,IAAI;GAC9C,IAAI,MAAM,QAAQ,IAAI,KAAK,KACpB;SAAA,MAAM,OAAO,MAChB,IAAI,OAAO,QAAQ,UACjB,OAAO,OAAO,IAAI,GAAG;GAAA;GAI3B,OAAO,QAAQ,QAAQ,QAAQ,WAAW,eAAe;EAC3D;CACF;AACF;AAEA,SAAgB,aACd,UAA2C,CAAC,GACtB;CACtB,MAAM,WAAW,YACf,OAAO,OAAO,UAAU,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC;CACrD,OAAO;EACL,IAAI;EACJ,UAAU,YACR,QAAQ,OAAO,MAAM,KAAA,KAAa,aAAa,QAAQ,OAAO;EAChE,UAAU,YACR,QAAQ,QAAQ,OAAO,CAAC,EAAE,SAAS,QAAQ,WAAW,eAAe;CACzE;AACF;AAEA,SAAgB,WACd,UAA2C,CAAC,GACtB;CACtB,MAAM,WAAW,YACf,OAAO,OAAO,UAAU,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC;CACrD,OAAO;EACL,IAAI;EACJ,UAAU,YACR,QAAQ,OAAO,MAAM,KAAA,KAAa,gBAAgB,QAAQ,OAAO;EACnE,UAAU,YACR,QACE,OAAO,QAAQ,OAAO,CAAC,EAAE,UAAU,CAAC,EAAE,SACtC,QAAQ,WAAW,eACrB;CACJ;AACF;AAEA,SAAgB,YACd,UAAkD,CAAC,GAC7B;CACtB,OAAO;EACL,IAAI;EACJ,UAAU,YAAY,CAAC,CAAC,OAAO,UAAU,OAAO,GAAG,WAAW;EAC9D,UAAU,YACR,QACE,OAAO,OAAO,OAAO,UAAU,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,EACnE,gBACJ,QAAQ,kBAAkB,eAC5B;CACJ;AACF;AAEA,SAAgB,eACd,UAA8B,CAAC,GACT;CACtB,MAAM,WAAW,YAA8B;EAC7C,MAAM,OAAO,OAAO,QAAQ,YAAY,CAAC,CAAC,QAAiB,CAAC;EAC5D,MAAM,QAAQ,QAAQ,SAAS;EAC/B,OAAO,QAAQ,OAAO,OAAO,MAAM,KAAK,IAAI,OAAO,KAAK,MAAM,IAAI,KAAA;CACpE;CACA,OAAO;EACL,IAAI;EACJ,UAAU,YAAY,QAAQ,OAAO,MAAM,KAAA;EAC3C,UAAU,YAAY,QAAQ,QAAQ,OAAO,GAAG,eAAe;CACjE;AACF;AAEA,MAAa,kBAAmD,OAAO,OAAO;CAC5E,YAAY;CACZ,YAAY;CACZ,aAAa;CACb,WAAW;CACX,YAAY;CACZ,eAAe;AACjB,CAAC;;;AClMD,SAAgB,aACd,UAA+B,CAAC,GACH;CAC7B,MAAM,WAAW,CAAC,GAAI,QAAQ,YAAY,eAAgB;CAC1D,MAAM,UAAU,YACd,SAAS,MAAM,YAAY,QAAQ,QAAQ,OAAO,CAAC;CACrD,MAAM,OAAO,YAAY;CACzB,OAAO;EACL,IAAI;EACJ,UAAU,EAAE,eAAe,KAAK;EAChC,UAAU,YAAY,QAAQ,QAAQ,MAAM;EAC5C,SAAS,SAAwB;GAC/B,MAAM,YAAY,QAAQ,YAAY,CAAC,CAAC,WAAoB;GAC5D,MAAM,MACJ,cAAc,QAAQ,OAAO,cAAc,WACvC,YACA,QAAQ,QAAQ;GACtB,OAAO;IACL;IACA,YAAY;IACZ,SAAS;IACT,UAAU;IACV,UAAU;KACR,MAAM,QAAQ,OAAO,OAAO,CAAC,EAAE,QAAQ,OAAO;KAC9C,IAAI;MACF,OAAO,IAAI,QAAQ,KAAK;KAC1B,QAAQ;MAGN,MAAM,aAAa,SAAS;OAC1B,QAAQ;OACR,QAAQ;MACV,CAAC;KACH;IACF;IACA,MAAM,MAAM;KACV,MAAM,OAAO,QAAQ,YAAY,CAAC,CAAC,QAAiB;KACpD,OAAO,SAAS,QACd,OAAO,SAAS,YAChB,OAAO,OAAO,MAAM,IAAI,IACrB,KAAiC,QAClC,KAAA;IACN;GACF;EACF;EACA,YAAY,SAAsB,SAAS;GACzC,MAAM,UAAU,OAAO,OAAO;GAC9B,OAAO,SAAS,cACZ,QAAQ,YAAY,SAAS,OAAO,IACpC,IAAI,aAAa;IACf,QAAQ;IACR,YAAY,QAAQ;IACpB,MAAM,QAAQ;IACd,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;IACnD,SAAS,QAAQ;GACnB,CAAC;EACP;EACA,oBAAoB,OAAO,SAAS,MAAM;GACxC,IAAI,CAAC,KAAK,QAAQ,OAAO,GACvB,OAAO;GAET,IAAI,CAAC,KAAK,UACR,IAAI,OAAO,eAAe,CAAC,CAAC,MAAM,KAAK;GAEzC,OAAO,IAAI,aAAa;IAAE,MAAM;IAAI,SAAS;GAAwB,CAAC;EACxE;EACA,SAAS,SAAqC;GAC5C,MAAM,MAAM;IACV,UAAgB,CAAC;GACnB;GACA,eAAe,8BAA8B,CAAC,CAC5C,MAAM,WACN,WACA,OAAO,yBAAyB,MAAM,WAAW,SAAS,CAC5D;GACA,MAAM,WAAoB,QAAQ,YAChC,yBACA,MAAM,UAAU,OAClB;GACA,IACE,CAAC,MAAM,QAAQ,QAAQ,KACvB,SAAS,OAAO,gCAEhB,MAAM,IAAI,6BACR,6BACA,6CACF;GAEF,MAAM,WAAW,QAAQ,kBAAkB,CAAC,QAAQ;GACpD,MAAM,UAAU,IAAI,gBAAgB;GACpC,KAAK,MAAM,WAAW,QAAQ,UAAU,eAAe,GAAG;IACxD,MAAM,SAAS,QAAQ;IACvB,IAAI,CAAC,QAAQ,aAAa,QAAQ,SAChC;IAEF,KAAK,MAAM,QAAQ,QAAQ,kBAAkB,OAAO,SAAS,GAAG;KAC9D,IACE,QAAQ,YACN,yBACA,OAAO,UAAU,KACnB,MAAM,KAAA,GAEN;KAEF,QAAQ,MAAM,QAAQ,MAAM,WAAW,aAAa,UAAU;MAC5D,MAAM;MACN,cAAc;MACd,UAAU,WAAY,QAAQ,kBAAkB,UAAW;MAC3D,MAAM;KACR,CAAC;IACH;GACF;EACF;EACA,SAAgC;GAC9B,OAAO,QAAQ,mBACX,CACE;IACE,OAAO;IACP,MAAM;IACN,SACE;GACJ,CACF,IACA,CAAC;EACP;CACF;AACF"}

package/dist/organization.cjs

@@ -0,0 +1,191 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_auth_errors = require("./auth-errors-DmiKl0L_.cjs");
+const require_auth_decorators = require("./auth-decorators-Cu_nxWnF.cjs");
+let better_auth_api = require("better-auth/api");
+//#region src/organization.ts
+const ACTIVE_ORGANIZATION_ID = Symbol.for("@nestjs-kit/better-auth:org:active-organization-id");
+const ACTIVE_MEMBER_ROLE = Symbol.for("@nestjs-kit/better-auth:org:active-member-role");
+const ActiveOrganizationId = require_auth_decorators.defineInvocationParam(ACTIVE_ORGANIZATION_ID, { missing: "ORGANIZATION_REQUIRED" });
+const ActiveMemberRole = require_auth_decorators.defineInvocationParam(ACTIVE_MEMBER_ROLE, { missing: "MEMBER_ROLE_REQUIRED" });
+const REF = Symbol.for("@nestjs-kit/better-auth:org:ref");
+function organizationRef(resolve, options = {}) {
+	return Object.assign((ctx) => resolve(ctx), options);
+}
+function activeOrganization() {
+	return Object.assign(organizationRef(async (ctx) => {
+		const value = ctx.principal.session.session?.activeOrganizationId;
+		if (value !== void 0) return value;
+		if (!await ctx.auth.hasPlugin("custom-session")) return;
+		try {
+			return (await ctx.memo(JSON.stringify(["org:activeMember"]), () => ctx.auth.run({
+				cookies: ctx.cookies,
+				inbound: () => ctx.headers,
+				internal: true
+			}, () => ctx.auth.api.getActiveMember({ headers: ctx.headers }))))?.organizationId;
+		} catch (error) {
+			if ((0, better_auth_api.isAPIError)(error) && error.statusCode === 400 && (error.body?.code === "NO_ACTIVE_ORGANIZATION" || error.body?.code === "MEMBER_NOT_FOUND")) return;
+			throw error;
+		}
+	}, { missingReason: "NO_ACTIVE_ORGANIZATION" }), { [REF]: { kind: "active" } });
+}
+function fromParam(name) {
+	return Object.assign(organizationRef((ctx) => ctx.param(name)), { [REF]: {
+		kind: "param",
+		name
+	} });
+}
+function fromHeader(name) {
+	return organizationRef((ctx) => ctx.headers.get(name));
+}
+function requirements(expressions) {
+	return expressions.flatMap((expression) => "anyOf" in expression ? requirements(expression.anyOf) : "allOf" in expression ? requirements(expression.allOf) : [expression]);
+}
+function advise(ctx, policy) {
+	const advice = [];
+	for (const handler of ctx.handlers) for (const requirement of requirements(handler.plan.requirements)) {
+		if (requirement.policy !== policy) continue;
+		const marker = requirement.params.organization[REF];
+		if (marker?.kind === "active") {
+			const input = handler.inputs.find((name) => [
+				"orgId",
+				"organizationId",
+				"organization",
+				"orgSlug"
+			].includes(name));
+			if (input) advice.push({
+				level: "warn",
+				code: "W_ORG_PARAM_IGNORED",
+				message: `${handler.plan.site} checks the active organization but accepts ${input}.`,
+				hint: input === "orgSlug" ? "Map the slug to an ID with organizationRef and auth.api.listOrganizations({ headers })." : `Use fromParam('${input}').`
+			});
+		} else if (marker?.kind === "param" && !handler.inputs.includes(marker.name)) advice.push({
+			level: "warn",
+			code: "W_ORG_PARAM_MISSING",
+			message: `${handler.plan.site} reads ${marker.name}, absent from claimed inputs: ${handler.inputs.join(", ") || "none"}.`,
+			hint: "Use the correct input name, a method-level organizationRef, or SkipDefaultRequirements with a method-level requirement."
+		});
+	}
+	return advice;
+}
+const requires = {
+	plugins: ["organization"],
+	principals: ["session"],
+	presentsCredentials: true
+};
+const orgPermissionPolicy = {
+	id: "better-auth:organization/permission",
+	requires,
+	advise: (ctx) => advise(ctx, orgPermissionPolicy),
+	validate({ permissions }) {
+		if (!Object.keys(permissions).length || Object.values(permissions).some((actions) => !Array.isArray(actions) || !actions.length)) throw new require_auth_errors.BetterAuthConfigurationError("EMPTY_PERMISSIONS", "Organization permissions must contain a resource and actions.");
+	},
+	async evaluate({ permissions, organization }, context) {
+		const organizationId = await organization(context);
+		if (typeof organizationId !== "string" || !organizationId.trim()) return {
+			effect: "deny",
+			reason: organization.missingReason ?? "ORGANIZATION_REQUIRED"
+		};
+		const stable = Object.entries(permissions).sort(([a], [b]) => a.localeCompare(b)).map(([resource, actions]) => [resource, [...actions].sort()]);
+		try {
+			if (!(await context.memo(JSON.stringify([
+				"org:hasPermission",
+				organizationId,
+				stable
+			]), () => context.auth.run({
+				cookies: context.cookies,
+				inbound: () => context.headers,
+				internal: true
+			}, () => context.auth.api.hasPermission({
+				headers: context.headers,
+				body: {
+					organizationId,
+					permissions
+				}
+			})))).success) return {
+				effect: "deny",
+				reason: "MISSING_PERMISSION"
+			};
+			context.provide(ACTIVE_ORGANIZATION_ID, organizationId);
+			return { effect: "allow" };
+		} catch (error) {
+			if ((0, better_auth_api.isAPIError)(error) && error.body?.code === "USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION") return {
+				effect: "deny",
+				reason: "USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION"
+			};
+			throw error;
+		}
+	}
+};
+const orgMemberPolicy = {
+	id: "better-auth:organization/member",
+	requires,
+	advise: (ctx) => advise(ctx, orgMemberPolicy),
+	async evaluate({ organization }, context) {
+		const organizationId = await organization(context);
+		if (typeof organizationId !== "string" || !organizationId.trim()) return {
+			effect: "deny",
+			reason: organization.missingReason ?? "ORGANIZATION_REQUIRED"
+		};
+		try {
+			const result = await context.memo(JSON.stringify(["org:activeMemberRole", organizationId]), () => context.auth.run({
+				cookies: context.cookies,
+				inbound: () => context.headers,
+				internal: true
+			}, () => context.auth.api.getActiveMemberRole({
+				headers: context.headers,
+				query: { organizationId }
+			})));
+			if (typeof result.role !== "string" || !result.role.trim()) return {
+				effect: "deny",
+				reason: "YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION"
+			};
+			context.provide(ACTIVE_ORGANIZATION_ID, organizationId);
+			context.provide(ACTIVE_MEMBER_ROLE, result.role);
+			return { effect: "allow" };
+		} catch (error) {
+			if ((0, better_auth_api.isAPIError)(error) && error.body?.code === "YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION") return {
+				effect: "deny",
+				reason: "YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION"
+			};
+			throw error;
+		}
+	}
+};
+function orgPermission(permissions, options = {}) {
+	return {
+		policy: orgPermissionPolicy,
+		params: {
+			permissions,
+			organization: options.organization ?? activeOrganization()
+		}
+	};
+}
+function RequireOrgPermission(permissions, options) {
+	return require_auth_decorators.Require(orgPermission(permissions, options));
+}
+function orgMember(options = {}) {
+	return {
+		policy: orgMemberPolicy,
+		params: { organization: options.organization ?? activeOrganization() }
+	};
+}
+function RequireOrgMember(options) {
+	return require_auth_decorators.Require(orgMember(options));
+}
+//#endregion
+exports.ACTIVE_MEMBER_ROLE = ACTIVE_MEMBER_ROLE;
+exports.ACTIVE_ORGANIZATION_ID = ACTIVE_ORGANIZATION_ID;
+exports.ActiveMemberRole = ActiveMemberRole;
+exports.ActiveOrganizationId = ActiveOrganizationId;
+exports.RequireOrgMember = RequireOrgMember;
+exports.RequireOrgPermission = RequireOrgPermission;
+exports.activeOrganization = activeOrganization;
+exports.fromHeader = fromHeader;
+exports.fromParam = fromParam;
+exports.orgMember = orgMember;
+exports.orgMemberPolicy = orgMemberPolicy;
+exports.orgPermission = orgPermission;
+exports.orgPermissionPolicy = orgPermissionPolicy;
+exports.organizationRef = organizationRef;
+
+//# sourceMappingURL=organization.cjs.map

package/dist/organization.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.cjs","names":["defineInvocationParam","isAPIError","BetterAuthConfigurationError","Require"],"sources":["../src/organization.ts"],"sourcesContent":["import { isAPIError } from \"better-auth/api\";\nimport type {\n  AuthorizationContext,\n  AuthorizationPolicy,\n  BootAdvice,\n  BootAdviceContext,\n  Requirement,\n  RequirementExpr,\n} from \"./auth-contracts.js\";\nimport { defineInvocationParam, Require } from \"./auth-decorators.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport type { OrgPermissions, SessionPrincipal } from \"./auth-types.js\";\nexport type { OrgPermissions } from \"./auth-types.js\";\nexport interface OrganizationRef {\n  (ctx: AuthorizationContext): unknown | Promise<unknown>;\n  readonly missingReason?: string;\n}\nexport interface OrgPermissionParams {\n  readonly permissions: OrgPermissions;\n  readonly organization: OrganizationRef;\n}\nexport interface OrgMemberParams {\n  readonly organization: OrganizationRef;\n}\nexport const ACTIVE_ORGANIZATION_ID = Symbol.for(\n  \"@nestjs-kit/better-auth:org:active-organization-id\",\n);\nexport const ACTIVE_MEMBER_ROLE = Symbol.for(\n  \"@nestjs-kit/better-auth:org:active-member-role\",\n);\nexport const ActiveOrganizationId = defineInvocationParam(\n  ACTIVE_ORGANIZATION_ID,\n  { missing: \"ORGANIZATION_REQUIRED\" },\n);\nexport const ActiveMemberRole = defineInvocationParam(ACTIVE_MEMBER_ROLE, {\n  missing: \"MEMBER_ROLE_REQUIRED\",\n});\nconst REF = Symbol.for(\"@nestjs-kit/better-auth:org:ref\");\ntype MarkedRef = OrganizationRef & {\n  readonly [REF]?: { kind: \"active\" } | { kind: \"param\"; name: string };\n};\ninterface OrgApi {\n  hasPermission(input: {\n    headers: Headers;\n    body: { organizationId: string; permissions: OrgPermissions };\n  }): Promise<{ success: boolean }>;\n  getActiveMemberRole(input: {\n    headers: Headers;\n    query: { organizationId: string };\n  }): Promise<{ role?: string | null }>;\n  getActiveMember(input: {\n    headers: Headers;\n  }): Promise<{ organizationId?: string }>;\n}\nexport function organizationRef(\n  resolve: (ctx: AuthorizationContext) => unknown | Promise<unknown>,\n  options: { missingReason?: string } = {},\n): OrganizationRef {\n  return Object.assign((ctx: AuthorizationContext) => resolve(ctx), options);\n}\nexport function activeOrganization(): OrganizationRef {\n  return Object.assign(\n    organizationRef(\n      async (ctx) => {\n        const session = (ctx.principal as SessionPrincipal).session as {\n          session?: { activeOrganizationId?: unknown };\n        };\n        const value = session.session?.activeOrganizationId;\n        if (value !== undefined) {\n          return value;\n        }\n        if (!(await ctx.auth.hasPlugin(\"custom-session\"))) {\n          return undefined;\n        }\n        try {\n          const member = await ctx.memo(\n            JSON.stringify([\"org:activeMember\"]),\n            () =>\n              ctx.auth.run(\n                {\n                  cookies: ctx.cookies,\n                  inbound: () => ctx.headers,\n                  internal: true,\n                },\n                () =>\n                  (ctx.auth.api as unknown as OrgApi).getActiveMember({\n                    headers: ctx.headers,\n                  }),\n              ),\n          );\n          return member?.organizationId;\n        } catch (error) {\n          if (\n            isAPIError(error) &&\n            error.statusCode === 400 &&\n            (error.body?.code === \"NO_ACTIVE_ORGANIZATION\" ||\n              error.body?.code === \"MEMBER_NOT_FOUND\")\n          ) {\n            return undefined;\n          }\n          throw error;\n        }\n      },\n      { missingReason: \"NO_ACTIVE_ORGANIZATION\" },\n    ),\n    { [REF]: { kind: \"active\" as const } },\n  );\n}\nexport function fromParam(name: string): OrganizationRef {\n  return Object.assign(\n    organizationRef((ctx) => ctx.param(name)),\n    { [REF]: { kind: \"param\" as const, name } },\n  );\n}\nexport function fromHeader(name: string): OrganizationRef {\n  return organizationRef((ctx) => ctx.headers.get(name));\n}\nfunction requirements(expressions: readonly RequirementExpr[]): Requirement[] {\n  return expressions.flatMap((expression) =>\n    \"anyOf\" in expression\n      ? requirements(expression.anyOf)\n      : \"allOf\" in expression\n        ? requirements(expression.allOf)\n        : [expression],\n  );\n}\nfunction advise(\n  ctx: BootAdviceContext,\n  policy: AuthorizationPolicy<any, any>,\n): BootAdvice[] {\n  const advice: BootAdvice[] = [];\n  for (const handler of ctx.handlers) {\n    for (const requirement of requirements(handler.plan.requirements)) {\n      if (requirement.policy !== policy) {\n        continue;\n      }\n      const ref = (requirement.params as OrgMemberParams)\n        .organization as MarkedRef;\n      const marker = ref[REF];\n      if (marker?.kind === \"active\") {\n        const input = handler.inputs.find((name) =>\n          [\"orgId\", \"organizationId\", \"organization\", \"orgSlug\"].includes(name),\n        );\n        if (input) {\n          advice.push({\n            level: \"warn\",\n            code: \"W_ORG_PARAM_IGNORED\",\n            message: `${handler.plan.site} checks the active organization but accepts ${input}.`,\n            hint:\n              input === \"orgSlug\"\n                ? \"Map the slug to an ID with organizationRef and auth.api.listOrganizations({ headers }).\"\n                : `Use fromParam('${input}').`,\n          });\n        }\n      } else if (\n        marker?.kind === \"param\" &&\n        !handler.inputs.includes(marker.name)\n      ) {\n        advice.push({\n          level: \"warn\",\n          code: \"W_ORG_PARAM_MISSING\",\n          message: `${handler.plan.site} reads ${marker.name}, absent from claimed inputs: ${handler.inputs.join(\", \") || \"none\"}.`,\n          hint: \"Use the correct input name, a method-level organizationRef, or SkipDefaultRequirements with a method-level requirement.\",\n        });\n      }\n    }\n  }\n  return advice;\n}\nconst requires = {\n  plugins: [\"organization\"],\n  principals: [\"session\" as const],\n  presentsCredentials: true,\n};\nexport const orgPermissionPolicy: AuthorizationPolicy<\n  OrgPermissionParams,\n  SessionPrincipal\n> = {\n  id: \"better-auth:organization/permission\", // gitleaks:allow: public policy identifier\n  requires,\n  advise: (ctx) => advise(ctx, orgPermissionPolicy),\n  validate({ permissions }) {\n    if (\n      !Object.keys(permissions).length ||\n      Object.values(permissions).some(\n        (actions) => !Array.isArray(actions) || !actions.length,\n      )\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"EMPTY_PERMISSIONS\",\n        \"Organization permissions must contain a resource and actions.\",\n      );\n    }\n  },\n  async evaluate({ permissions, organization }, context) {\n    const organizationId = await organization(context);\n    if (typeof organizationId !== \"string\" || !organizationId.trim()) {\n      return {\n        effect: \"deny\",\n        reason: organization.missingReason ?? \"ORGANIZATION_REQUIRED\",\n      };\n    }\n    const stable = Object.entries(permissions)\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([resource, actions]) => [resource, [...actions].sort()]);\n    try {\n      const result = await context.memo(\n        JSON.stringify([\"org:hasPermission\", organizationId, stable]),\n        () =>\n          context.auth.run(\n            {\n              cookies: context.cookies,\n              inbound: () => context.headers,\n              internal: true,\n            },\n            () =>\n              (context.auth.api as unknown as OrgApi).hasPermission({\n                headers: context.headers,\n                body: { organizationId, permissions },\n              }),\n          ),\n      );\n      if (!result.success) {\n        return { effect: \"deny\", reason: \"MISSING_PERMISSION\" };\n      }\n      context.provide(ACTIVE_ORGANIZATION_ID, organizationId);\n      return { effect: \"allow\" };\n    } catch (error) {\n      if (\n        isAPIError(error) &&\n        error.body?.code === \"USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION\"\n      ) {\n        return {\n          effect: \"deny\",\n          reason: \"USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION\",\n        };\n      }\n      throw error;\n    }\n  },\n};\nexport const orgMemberPolicy: AuthorizationPolicy<\n  OrgMemberParams,\n  SessionPrincipal\n> = {\n  id: \"better-auth:organization/member\",\n  requires,\n  advise: (ctx) => advise(ctx, orgMemberPolicy),\n  async evaluate({ organization }, context) {\n    const organizationId = await organization(context);\n    if (typeof organizationId !== \"string\" || !organizationId.trim()) {\n      return {\n        effect: \"deny\",\n        reason: organization.missingReason ?? \"ORGANIZATION_REQUIRED\",\n      };\n    }\n    try {\n      const result = await context.memo(\n        JSON.stringify([\"org:activeMemberRole\", organizationId]),\n        () =>\n          context.auth.run(\n            {\n              cookies: context.cookies,\n              inbound: () => context.headers,\n              internal: true,\n            },\n            () =>\n              (context.auth.api as unknown as OrgApi).getActiveMemberRole({\n                headers: context.headers,\n                query: { organizationId },\n              }),\n          ),\n      );\n      if (typeof result.role !== \"string\" || !result.role.trim()) {\n        return {\n          effect: \"deny\",\n          reason: \"YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION\",\n        };\n      }\n      context.provide(ACTIVE_ORGANIZATION_ID, organizationId);\n      context.provide(ACTIVE_MEMBER_ROLE, result.role);\n      return { effect: \"allow\" };\n    } catch (error) {\n      if (\n        isAPIError(error) &&\n        error.body?.code === \"YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION\"\n      ) {\n        return {\n          effect: \"deny\",\n          reason: \"YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION\",\n        };\n      }\n      throw error;\n    }\n  },\n};\nexport function orgPermission<N extends string = \"default\">(\n  permissions: OrgPermissions<N>,\n  options: { organization?: OrganizationRef } = {},\n): Requirement<OrgPermissionParams> {\n  return {\n    policy: orgPermissionPolicy,\n    params: {\n      permissions: permissions as OrgPermissions,\n      organization: options.organization ?? activeOrganization(),\n    },\n  };\n}\nexport function RequireOrgPermission<N extends string = \"default\">(\n  permissions: OrgPermissions<N>,\n  options?: { organization?: OrganizationRef },\n): ClassDecorator & MethodDecorator {\n  return Require(orgPermission<N>(permissions, options));\n}\nexport function orgMember(\n  options: { organization?: OrganizationRef } = {},\n): Requirement<OrgMemberParams> {\n  return {\n    policy: orgMemberPolicy,\n    params: { organization: options.organization ?? activeOrganization() },\n  };\n}\nexport function RequireOrgMember(options?: {\n  organization?: OrganizationRef;\n}): ClassDecorator & MethodDecorator {\n  return Require(orgMember(options));\n}\n"],"mappings":";;;;;AAwBA,MAAa,yBAAyB,OAAO,IAC3C,oDACF;AACA,MAAa,qBAAqB,OAAO,IACvC,gDACF;AACA,MAAa,uBAAuBA,wBAAAA,sBAClC,wBACA,EAAE,SAAS,wBAAwB,CACrC;AACA,MAAa,mBAAmBA,wBAAAA,sBAAsB,oBAAoB,EACxE,SAAS,uBACX,CAAC;AACD,MAAM,MAAM,OAAO,IAAI,iCAAiC;AAiBxD,SAAgB,gBACd,SACA,UAAsC,CAAC,GACtB;CACjB,OAAO,OAAO,QAAQ,QAA8B,QAAQ,GAAG,GAAG,OAAO;AAC3E;AACA,SAAgB,qBAAsC;CACpD,OAAO,OAAO,OACZ,gBACE,OAAO,QAAQ;EAIb,MAAM,QAHW,IAAI,UAA+B,QAG9B,SAAS;EAC/B,IAAI,UAAU,KAAA,GACZ,OAAO;EAET,IAAI,CAAE,MAAM,IAAI,KAAK,UAAU,gBAAgB,GAC7C;EAEF,IAAI;GAgBF,QAAO,MAfc,IAAI,KACvB,KAAK,UAAU,CAAC,kBAAkB,CAAC,SAEjC,IAAI,KAAK,IACP;IACE,SAAS,IAAI;IACb,eAAe,IAAI;IACnB,UAAU;GACZ,SAEG,IAAI,KAAK,IAA0B,gBAAgB,EAClD,SAAS,IAAI,QACf,CAAC,CACL,CACJ,EAAA,EACe;EACjB,SAAS,OAAO;GACd,KAAA,GACEC,gBAAAA,WAAAA,CAAW,KAAK,KAChB,MAAM,eAAe,QACpB,MAAM,MAAM,SAAS,4BACpB,MAAM,MAAM,SAAS,qBAEvB;GAEF,MAAM;EACR;CACF,GACA,EAAE,eAAe,yBAAyB,CAC5C,GACA,GAAG,MAAM,EAAE,MAAM,SAAkB,EAAE,CACvC;AACF;AACA,SAAgB,UAAU,MAA+B;CACvD,OAAO,OAAO,OACZ,iBAAiB,QAAQ,IAAI,MAAM,IAAI,CAAC,GACxC,GAAG,MAAM;EAAE,MAAM;EAAkB;CAAK,EAAE,CAC5C;AACF;AACA,SAAgB,WAAW,MAA+B;CACxD,OAAO,iBAAiB,QAAQ,IAAI,QAAQ,IAAI,IAAI,CAAC;AACvD;AACA,SAAS,aAAa,aAAwD;CAC5E,OAAO,YAAY,SAAS,eAC1B,WAAW,aACP,aAAa,WAAW,KAAK,IAC7B,WAAW,aACT,aAAa,WAAW,KAAK,IAC7B,CAAC,UAAU,CACnB;AACF;AACA,SAAS,OACP,KACA,QACc;CACd,MAAM,SAAuB,CAAC;CAC9B,KAAK,MAAM,WAAW,IAAI,UACxB,KAAK,MAAM,eAAe,aAAa,QAAQ,KAAK,YAAY,GAAG;EACjE,IAAI,YAAY,WAAW,QACzB;EAIF,MAAM,SAFO,YAAY,OACtB,aACgB;EACnB,IAAI,QAAQ,SAAS,UAAU;GAC7B,MAAM,QAAQ,QAAQ,OAAO,MAAM,SACjC;IAAC;IAAS;IAAkB;IAAgB;GAAS,CAAC,CAAC,SAAS,IAAI,CACtE;GACA,IAAI,OACF,OAAO,KAAK;IACV,OAAO;IACP,MAAM;IACN,SAAS,GAAG,QAAQ,KAAK,KAAK,8CAA8C,MAAM;IAClF,MACE,UAAU,YACN,4FACA,kBAAkB,MAAM;GAChC,CAAC;EAEL,OAAO,IACL,QAAQ,SAAS,WACjB,CAAC,QAAQ,OAAO,SAAS,OAAO,IAAI,GAEpC,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,GAAG,QAAQ,KAAK,KAAK,SAAS,OAAO,KAAK,gCAAgC,QAAQ,OAAO,KAAK,IAAI,KAAK,OAAO;GACvH,MAAM;EACR,CAAC;CAEL;CAEF,OAAO;AACT;AACA,MAAM,WAAW;CACf,SAAS,CAAC,cAAc;CACxB,YAAY,CAAC,SAAkB;CAC/B,qBAAqB;AACvB;AACA,MAAa,sBAGT;CACF,IAAI;CACJ;CACA,SAAS,QAAQ,OAAO,KAAK,mBAAmB;CAChD,SAAS,EAAE,eAAe;EACxB,IACE,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,UAC1B,OAAO,OAAO,WAAW,CAAC,CAAC,MACxB,YAAY,CAAC,MAAM,QAAQ,OAAO,KAAK,CAAC,QAAQ,MACnD,GAEA,MAAM,IAAIC,oBAAAA,6BACR,qBACA,+DACF;CAEJ;CACA,MAAM,SAAS,EAAE,aAAa,gBAAgB,SAAS;EACrD,MAAM,iBAAiB,MAAM,aAAa,OAAO;EACjD,IAAI,OAAO,mBAAmB,YAAY,CAAC,eAAe,KAAK,GAC7D,OAAO;GACL,QAAQ;GACR,QAAQ,aAAa,iBAAiB;EACxC;EAEF,MAAM,SAAS,OAAO,QAAQ,WAAW,CAAC,CACvC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,UAAU,aAAa,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;EAC/D,IAAI;GAiBF,IAAI,EAAC,MAhBgB,QAAQ,KAC3B,KAAK,UAAU;IAAC;IAAqB;IAAgB;GAAM,CAAC,SAE1D,QAAQ,KAAK,IACX;IACE,SAAS,QAAQ;IACjB,eAAe,QAAQ;IACvB,UAAU;GACZ,SAEG,QAAQ,KAAK,IAA0B,cAAc;IACpD,SAAS,QAAQ;IACjB,MAAM;KAAE;KAAgB;IAAY;GACtC,CAAC,CACL,CACJ,EAAA,CACY,SACV,OAAO;IAAE,QAAQ;IAAQ,QAAQ;GAAqB;GAExD,QAAQ,QAAQ,wBAAwB,cAAc;GACtD,OAAO,EAAE,QAAQ,QAAQ;EAC3B,SAAS,OAAO;GACd,KAAA,GACED,gBAAAA,WAAAA,CAAW,KAAK,KAChB,MAAM,MAAM,SAAS,4CAErB,OAAO;IACL,QAAQ;IACR,QAAQ;GACV;GAEF,MAAM;EACR;CACF;AACF;AACA,MAAa,kBAGT;CACF,IAAI;CACJ;CACA,SAAS,QAAQ,OAAO,KAAK,eAAe;CAC5C,MAAM,SAAS,EAAE,gBAAgB,SAAS;EACxC,MAAM,iBAAiB,MAAM,aAAa,OAAO;EACjD,IAAI,OAAO,mBAAmB,YAAY,CAAC,eAAe,KAAK,GAC7D,OAAO;GACL,QAAQ;GACR,QAAQ,aAAa,iBAAiB;EACxC;EAEF,IAAI;GACF,MAAM,SAAS,MAAM,QAAQ,KAC3B,KAAK,UAAU,CAAC,wBAAwB,cAAc,CAAC,SAErD,QAAQ,KAAK,IACX;IACE,SAAS,QAAQ;IACjB,eAAe,QAAQ;IACvB,UAAU;GACZ,SAEG,QAAQ,KAAK,IAA0B,oBAAoB;IAC1D,SAAS,QAAQ;IACjB,OAAO,EAAE,eAAe;GAC1B,CAAC,CACL,CACJ;GACA,IAAI,OAAO,OAAO,SAAS,YAAY,CAAC,OAAO,KAAK,KAAK,GACvD,OAAO;IACL,QAAQ;IACR,QAAQ;GACV;GAEF,QAAQ,QAAQ,wBAAwB,cAAc;GACtD,QAAQ,QAAQ,oBAAoB,OAAO,IAAI;GAC/C,OAAO,EAAE,QAAQ,QAAQ;EAC3B,SAAS,OAAO;GACd,KAAA,GACEA,gBAAAA,WAAAA,CAAW,KAAK,KAChB,MAAM,MAAM,SAAS,6CAErB,OAAO;IACL,QAAQ;IACR,QAAQ;GACV;GAEF,MAAM;EACR;CACF;AACF;AACA,SAAgB,cACd,aACA,UAA8C,CAAC,GACb;CAClC,OAAO;EACL,QAAQ;EACR,QAAQ;GACO;GACb,cAAc,QAAQ,gBAAgB,mBAAmB;EAC3D;CACF;AACF;AACA,SAAgB,qBACd,aACA,SACkC;CAClC,OAAOE,wBAAAA,QAAQ,cAAiB,aAAa,OAAO,CAAC;AACvD;AACA,SAAgB,UACd,UAA8C,CAAC,GACjB;CAC9B,OAAO;EACL,QAAQ;EACR,QAAQ,EAAE,cAAc,QAAQ,gBAAgB,mBAAmB,EAAE;CACvE;AACF;AACA,SAAgB,iBAAiB,SAEI;CACnC,OAAOA,wBAAAA,QAAQ,UAAU,OAAO,CAAC;AACnC"}

package/dist/organization.d.cts

@@ -0,0 +1,40 @@
+import { Mt as OrgPermissions, f as AuthorizationPolicy, l as AuthorizationContext, ot as Requirement, zt as SessionPrincipal } from "./auth-contracts-Brh_Qko9.cjs";
+//#region src/organization.d.ts
+export interface OrganizationRef {
+  (ctx: AuthorizationContext): unknown | Promise<unknown>;
+  readonly missingReason?: string;
+}
+export interface OrgPermissionParams {
+  readonly permissions: OrgPermissions;
+  readonly organization: OrganizationRef;
+}
+export interface OrgMemberParams {
+  readonly organization: OrganizationRef;
+}
+export declare const ACTIVE_ORGANIZATION_ID: unique symbol;
+export declare const ACTIVE_MEMBER_ROLE: unique symbol;
+export declare const ActiveOrganizationId: () => ParameterDecorator;
+export declare const ActiveMemberRole: () => ParameterDecorator;
+export declare function organizationRef(resolve: (ctx: AuthorizationContext) => unknown | Promise<unknown>, options?: {
+  missingReason?: string;
+}): OrganizationRef;
+export declare function activeOrganization(): OrganizationRef;
+export declare function fromParam(name: string): OrganizationRef;
+export declare function fromHeader(name: string): OrganizationRef;
+export declare const orgPermissionPolicy: AuthorizationPolicy<OrgPermissionParams, SessionPrincipal>;
+export declare const orgMemberPolicy: AuthorizationPolicy<OrgMemberParams, SessionPrincipal>;
+export declare function orgPermission<N extends string = "default">(permissions: OrgPermissions<N>, options?: {
+  organization?: OrganizationRef;
+}): Requirement<OrgPermissionParams>;
+export declare function RequireOrgPermission<N extends string = "default">(permissions: OrgPermissions<N>, options?: {
+  organization?: OrganizationRef;
+}): ClassDecorator & MethodDecorator;
+export declare function orgMember(options?: {
+  organization?: OrganizationRef;
+}): Requirement<OrgMemberParams>;
+export declare function RequireOrgMember(options?: {
+  organization?: OrganizationRef;
+}): ClassDecorator & MethodDecorator;
+//#endregion
+export type { OrgPermissions };
+//# sourceMappingURL=organization.d.cts.map

package/dist/organization.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.d.cts","names":[],"sources":["../src/organization.ts"],"mappings":";;iBAaiB;GACd,KAAK,iCAAiC;WAC9B;;iBAEM;WACN,aAAa;WACb,cAAc;;iBAER;WACN,cAAc;;qBAEZ;qBAGA;qBAGA,4BAAoB;qBAIpB,wBAAgB;wBAoBb,gBACd,UAAU,KAAK,mCAAmC,kBAClD;EAAW;IACV;wBAGa,sBAAsB;wBAgDtB,UAAU,eAAe;wBAMzB,WAAW,eAAe;qBA4D7B,qBAAqB,oBAChC,qBACA;qBAiEW,iBAAiB,oBAC5B,iBACA;wBAqDc,cAAc,8BAC5B,aAAa,eAAe,IAC5B;EAAW,eAAe;IACzB,YAAY;wBASC,qBAAqB,8BACnC,aAAa,eAAe,IAC5B;EAAY,eAAe;IAC1B,iBAAiB;wBAGJ,UACd;EAAW,eAAe;IACzB,YAAY;wBAMC,iBAAiB;EAC/B,eAAe;IACb,iBAAiB"}

package/dist/organization.d.mts

@@ -0,0 +1,40 @@
+import { Mt as OrgPermissions, f as AuthorizationPolicy, l as AuthorizationContext, ot as Requirement, zt as SessionPrincipal } from "./auth-contracts-Cz7C4_Ch.mjs";
+//#region src/organization.d.ts
+export interface OrganizationRef {
+  (ctx: AuthorizationContext): unknown | Promise<unknown>;
+  readonly missingReason?: string;
+}
+export interface OrgPermissionParams {
+  readonly permissions: OrgPermissions;
+  readonly organization: OrganizationRef;
+}
+export interface OrgMemberParams {
+  readonly organization: OrganizationRef;
+}
+export declare const ACTIVE_ORGANIZATION_ID: unique symbol;
+export declare const ACTIVE_MEMBER_ROLE: unique symbol;
+export declare const ActiveOrganizationId: () => ParameterDecorator;
+export declare const ActiveMemberRole: () => ParameterDecorator;
+export declare function organizationRef(resolve: (ctx: AuthorizationContext) => unknown | Promise<unknown>, options?: {
+  missingReason?: string;
+}): OrganizationRef;
+export declare function activeOrganization(): OrganizationRef;
+export declare function fromParam(name: string): OrganizationRef;
+export declare function fromHeader(name: string): OrganizationRef;
+export declare const orgPermissionPolicy: AuthorizationPolicy<OrgPermissionParams, SessionPrincipal>;
+export declare const orgMemberPolicy: AuthorizationPolicy<OrgMemberParams, SessionPrincipal>;
+export declare function orgPermission<N extends string = "default">(permissions: OrgPermissions<N>, options?: {
+  organization?: OrganizationRef;
+}): Requirement<OrgPermissionParams>;
+export declare function RequireOrgPermission<N extends string = "default">(permissions: OrgPermissions<N>, options?: {
+  organization?: OrganizationRef;
+}): ClassDecorator & MethodDecorator;
+export declare function orgMember(options?: {
+  organization?: OrganizationRef;
+}): Requirement<OrgMemberParams>;
+export declare function RequireOrgMember(options?: {
+  organization?: OrganizationRef;
+}): ClassDecorator & MethodDecorator;
+//#endregion
+export type { OrgPermissions };
+//# sourceMappingURL=organization.d.mts.map

package/dist/organization.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.d.mts","names":[],"sources":["../src/organization.ts"],"mappings":";;iBAaiB;GACd,KAAK,iCAAiC;WAC9B;;iBAEM;WACN,aAAa;WACb,cAAc;;iBAER;WACN,cAAc;;qBAEZ;qBAGA;qBAGA,4BAAoB;qBAIpB,wBAAgB;wBAoBb,gBACd,UAAU,KAAK,mCAAmC,kBAClD;EAAW;IACV;wBAGa,sBAAsB;wBAgDtB,UAAU,eAAe;wBAMzB,WAAW,eAAe;qBA4D7B,qBAAqB,oBAChC,qBACA;qBAiEW,iBAAiB,oBAC5B,iBACA;wBAqDc,cAAc,8BAC5B,aAAa,eAAe,IAC5B;EAAW,eAAe;IACzB,YAAY;wBASC,qBAAqB,8BACnC,aAAa,eAAe,IAC5B;EAAY,eAAe;IAC1B,iBAAiB;wBAGJ,UACd;EAAW,eAAe;IACzB,YAAY;wBAMC,iBAAiB;EAC/B,eAAe;IACb,iBAAiB"}