@nextsparkjs/core 0.1.0-beta.184 → 0.1.0-beta.185

package/dist/hooks/useAuth.d.ts

@@ -2,44 +2,54 @@ import type { SessionUser } from '../lib/auth';
 export declare function useAuth(): {
     user: SessionUser | null;
     session: {
-        user: {
+        user: import("better-auth").StripEmptyObjects<{
             id: string;
-            emailVerified: boolean;
-            name: string;
             createdAt: Date;
             updatedAt: Date;
+            emailVerified: boolean;
+            name: string;
             email?: string;
             image?: string;
-        };
-        session: {
+        } & {} & {}>;
+        session: import("better-auth").StripEmptyObjects<{
             id: string;
-            userId: string;
-            expiresAt: Date;
             createdAt: Date;
             updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
             token: string;
             ipAddress?: string;
             userAgent?: string;
-        };
+        } & {} & {}>;
     };
     isLoading: boolean;
     signIn: ({ email, password, redirectTo }: {
         email: string;
         password: string;
         redirectTo?: string;
-    }) => Promise<{
+    }) => Promise<Omit<{
         redirect: boolean;
         token: string;
-        url: string | undefined;
+        url?: string | undefined;
         user: {
             id: string;
+            createdAt: Date;
+            updatedAt: Date;
             email: string;
-            name: string;
-            image: string | null | undefined;
             emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+        };
+    }, "user"> & {
+        user: import("better-auth").StripEmptyObjects<{
+            id: string;
             createdAt: Date;
             updatedAt: Date;
-        };
+            emailVerified: boolean;
+            name: string;
+            email?: string;
+            image?: string;
+        } & {} & {}>;
     }>;
     signUp: ({ email, password, firstName, lastName, intent }: {
         email: string;
@@ -47,29 +57,49 @@ export declare function useAuth(): {
         firstName?: string;
         lastName?: string;
         intent?: string;
-    }) => Promise<NonNullable<{
+    }) => Promise<(Omit<{
         token: null;
         user: {
             id: string;
+            createdAt: Date;
+            updatedAt: Date;
             email: string;
-            name: string;
-            image: string | null | undefined;
             emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+        };
+    }, "user"> & {
+        user: import("better-auth").StripEmptyObjects<{
+            id: string;
             createdAt: Date;
             updatedAt: Date;
-        };
-    } | {
+            emailVerified: boolean;
+            name: string;
+            email?: string;
+            image?: string;
+        } & {} & {}>;
+    }) | (Omit<{
         token: string;
         user: {
             id: string;
+            createdAt: Date;
+            updatedAt: Date;
             email: string;
-            name: string;
-            image: string | null | undefined;
             emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+        };
+    }, "user"> & {
+        user: import("better-auth").StripEmptyObjects<{
+            id: string;
             createdAt: Date;
             updatedAt: Date;
-        };
-    }>>;
+            emailVerified: boolean;
+            name: string;
+            email?: string;
+            image?: string;
+        } & {} & {}>;
+    })>;
     signOut: () => Promise<void>;
     googleSignIn: (redirectTo?: string) => Promise<void>;
     resetPassword: (email: string) => Promise<{
@@ -80,6 +110,7 @@ export declare function useAuth(): {
         success: boolean;
         data: {
             status: boolean;
+            message: string;
         };
         error: any;
     }>;
@@ -100,17 +131,35 @@ export declare function useAuth(): {
         error: string;
     } | {
         success: boolean;
-        data: {
+        data: Omit<{
             token: string | null;
             user: {
                 id: string;
+                createdAt: Date;
+                updatedAt: Date;
                 email: string;
-                name: string;
-                image: string | null | undefined;
                 emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            } & Record<string, any> & {
+                id: string;
                 createdAt: Date;
                 updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
             };
+        }, "user"> & {
+            user: import("better-auth").StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                emailVerified: boolean;
+                name: string;
+                email?: string;
+                image?: string;
+            } & {} & {}>;
         };
         error: any;
     }>;

package/dist/hooks/useAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/hooks/useAuth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAS9C,wBAAgB,OAAO;UAuMS,WAAW,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;;8CAjMa;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;+DAmBvC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;gCAkC1H,MAAM;2BAYX,MAAM;;;;;;;;;;;kCA6BC,MAAM,UAAU,MAAM;;;;;;;;;;;sCAwClB,MAAM,eAAe,MAAM;;;;;;;;;;;;;;;;;;;;qCA8B5B,MAAM;;;;;;;;;;;;;;;EA6C3D"}
+{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/hooks/useAuth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAS9C,wBAAgB,OAAO;UAuMS,WAAW,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;;8CAjMa;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;+DAmBvC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAkC1H,MAAM;2BAYX,MAAM;;;;;;;;;;;;kCA6BC,MAAM,UAAU,MAAM;;;;;;;;;;;sCAwClB,MAAM,eAAe,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8B5B,MAAM;;;;;;;;;;;;;;;EA6C3D"}

package/dist/hooks/useValidationSchemas.d.ts

@@ -6,37 +6,37 @@ export declare function useValidationSchemas(): {
     login: import("zod").ZodObject<{
         email: import("zod").ZodString;
         password: import("zod").ZodString;
-    }, import("better-auth").$strip>;
+    }, import("zod/v4/core").$strip>;
     signup: import("zod").ZodObject<{
         firstName: import("zod").ZodString;
         lastName: import("zod").ZodString;
         email: import("zod").ZodString;
         password: import("zod").ZodString;
         confirmPassword: import("zod").ZodString;
-    }, import("better-auth").$strip>;
+    }, import("zod/v4/core").$strip>;
     resetPassword: import("zod").ZodObject<{
         email: import("zod").ZodString;
-    }, import("better-auth").$strip>;
+    }, import("zod/v4/core").$strip>;
     newPassword: import("zod").ZodObject<{
         password: import("zod").ZodString;
         confirmPassword: import("zod").ZodString;
-    }, import("better-auth").$strip>;
+    }, import("zod/v4/core").$strip>;
     changePassword: import("zod").ZodObject<{
         currentPassword: import("zod").ZodString;
         newPassword: import("zod").ZodString;
         confirmPassword: import("zod").ZodString;
         revokeOtherSessions: import("zod").ZodOptional<import("zod").ZodBoolean>;
-    }, import("better-auth").$strip>;
+    }, import("zod/v4/core").$strip>;
     profile: import("zod").ZodObject<{
         firstName: import("zod").ZodString;
         lastName: import("zod").ZodString;
         country: import("zod").ZodString;
         timezone: import("zod").ZodString;
         language: import("zod").ZodString;
-    }, import("better-auth").$strip>;
+    }, import("zod/v4/core").$strip>;
     task: import("zod").ZodObject<{
         title: import("zod").ZodString;
         description: import("zod").ZodOptional<import("zod").ZodString>;
-    }, import("better-auth").$strip>;
+    }, import("zod/v4/core").$strip>;
 };
 //# sourceMappingURL=useValidationSchemas.d.ts.map

package/dist/lib/api/auth/dual-auth.d.ts

@@ -49,6 +49,13 @@ export interface DualAuthResult {
 export declare function authenticateRequest(request: NextRequest): Promise<DualAuthResult>;
 /**
  * Check if user has required scope (for API Key auth)
+ *
+ * `admin:all` was previously accepted as an implicit full-access scope here,
+ * but it was never in `API_SCOPES`, never mintable via `validateScopesForUser`,
+ * and undocumented — a full-access string nothing legitimately produced.
+ * Removed rather than formalized: the wildcard `*` (mintable only by a real
+ * superadmin, see `validateScopesForUser`) already covers the "this key has
+ * full access" case in a documented, auditable way.
  */
 export declare function hasRequiredScope(authResult: DualAuthResult, requiredScope: string): boolean;
 /**

package/dist/lib/api/auth/dual-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dual-auth.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/dual-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAUvD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAA;AAExD;;GAEG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAA;AACnD,eAAO,MAAM,kBAAkB,8BAA8B,CAAA;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAA;AAOjD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAA;IACpC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,iBAAiB,CAAC,EAAE,QAAQ,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAC5D;AAqBD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAkBvF;AAqKD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAY3F;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,CAsChC;AAMD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,cAAc,EAC1B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAkBD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,MAAkC,EAAE,MAAM,GAAE,MAAY;;;;GAShG"}
+{"version":3,"file":"dual-auth.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/dual-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAUvD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAA;AAExD;;GAEG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAA;AACnD,eAAO,MAAM,kBAAkB,8BAA8B,CAAA;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAA;AAOjD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAA;IACpC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,iBAAiB,CAAC,EAAE,QAAQ,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAC5D;AAqBD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAkBvF;AAqKD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAW3F;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,CAsChC;AAMD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,cAAc,EAC1B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAkBD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,MAAkC,EAAE,MAAM,GAAE,MAAY;;;;GAShG"}

package/dist/lib/api/auth/dual-auth.js

@@ -145,7 +145,7 @@ function hasRequiredScope(authResult, requiredScope) {
     return true;
   }
   if (authResult.type === "api-key" && authResult.scopes) {
-    return authResult.scopes.includes(requiredScope) || authResult.scopes.includes("admin:all") || authResult.scopes.includes("*");
+    return authResult.scopes.includes(requiredScope) || authResult.scopes.includes("*");
   }
   return false;
 }

package/dist/lib/api/auth.d.ts

@@ -44,13 +44,30 @@ export declare function getApiKeyUser(auth: ApiKeyAuth): Promise<{
     role: string;
 }>;
 /**
- * Verifica si un usuario puede crear API keys
+ * Verifica si un usuario puede crear API keys.
+ *
+ * Superadmin is a GLOBAL role (`users.role`) and is always allowed. Any
+ * other user is allowed only if they hold a team role that itself grants
+ * `admin:api-keys`/`admin:users`-equivalent scopes for at least one team —
+ * i.e. the same source of truth `validateScopesForUser` uses, checked
+ * without a specific team in mind (any qualifying membership is enough).
  */
 export declare function canCreateApiKeys(userId: string): Promise<boolean>;
 /**
- * Valida que los scopes solicitados sean permitidos para el usuario
+ * Valida que los scopes solicitados sean permitidos para el usuario, en el
+ * contexto de un team específico.
+ *
+ * Superadmin is a GLOBAL role (`users.role`) — it never appears in
+ * `AVAILABLE_ROLES` (team roles), so it's special-cased here rather than
+ * inside the scope registry. Every other user is resolved through their
+ * TEAM role for `teamId` (not their global `users.role` — NextSpark's
+ * entity authorization model is team-scoped, see `app.config.ts`), and the
+ * allowed-scope set comes from the same registry-backed
+ * `ScopeService.getRoleScopes()` that session auth's implicit scopes
+ * (`generateScopesForRole` in `helpers.ts`) and `checkPermission()` both
+ * ultimately derive from — so minting and enforcement can't diverge again.
  */
-export declare function validateScopesForUser(userId: string, requestedScopes: string[]): Promise<{
+export declare function validateScopesForUser(userId: string, teamId: string | null, requestedScopes: string[]): Promise<{
     valid: boolean;
     allowedScopes: string[];
     deniedScopes: string[];

package/dist/lib/api/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK1C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAoHrF;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAM/E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhF;AAiBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU;QAG1C,MAAM;WACH,MAAM;eACF,MAAM,GAAG,IAAI;cACd,MAAM,GAAG,IAAI;UACjB,MAAM;GAWjB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBvE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC9F,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAuDD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAoHrF;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAM/E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhF;AAiBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU;QAG1C,MAAM;WACH,MAAM;eACF,MAAM,GAAG,IAAI;cACd,MAAM,GAAG,IAAI;UACjB,MAAM;GAWjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAyED"}

package/dist/lib/api/auth.js

@@ -1,6 +1,8 @@
 import { queryOne } from "../db.js";
 import { ApiKeyManager } from "./keys.js";
 import { apiKeyCache, getCacheKey } from "./cache.js";
+import { TeamMemberService } from "../services/team-member.service.js";
+import { ScopeService } from "../services/scope.service.js";
 function hasScope(auth, requiredScope) {
   return auth.scopes.includes(requiredScope);
 }
@@ -154,13 +156,20 @@ async function canCreateApiKeys(userId) {
     if (!user) {
       return false;
     }
-    return ["admin", "superadmin"].includes(user.role);
+    if (user.role === "superadmin") {
+      return true;
+    }
+    const memberships = await TeamMemberService.listByUser(userId);
+    return memberships.some(({ role }) => {
+      const scopes = ScopeService.getRoleScopes(role);
+      return scopes.includes("*") || scopes.includes("admin:api-keys");
+    });
   } catch (error) {
     console.error("Error checking API key creation permissions:", error);
     return false;
   }
 }
-async function validateScopesForUser(userId, requestedScopes) {
+async function validateScopesForUser(userId, teamId, requestedScopes) {
   try {
     const user = await queryOne(
       'SELECT role FROM "users" WHERE id = $1',
@@ -173,23 +182,32 @@ async function validateScopesForUser(userId, requestedScopes) {
         deniedScopes: requestedScopes
       };
     }
-    const scopesByRole = {
-      member: ["tasks:read", "tasks:write"],
-      colaborator: ["tasks:read", "tasks:write", "tasks:delete", "users:read"],
-      admin: [
-        "users:read",
-        "users:write",
-        "users:delete",
-        "tasks:read",
-        "tasks:write",
-        "tasks:delete",
-        "admin:api-keys",
-        "admin:users"
-      ],
-      superadmin: ["*"]
-      // Acceso completo
-    };
-    const allowedScopes = scopesByRole[user.role] || [];
+    if (user.role === "superadmin") {
+      return {
+        valid: true,
+        allowedScopes: requestedScopes,
+        deniedScopes: []
+      };
+    }
+    if (!teamId) {
+      return {
+        valid: false,
+        allowedScopes: [],
+        deniedScopes: requestedScopes
+      };
+    }
+    const teamRole = await TeamMemberService.getRole(teamId, userId);
+    if (!teamRole) {
+      return {
+        valid: false,
+        allowedScopes: [],
+        deniedScopes: requestedScopes
+      };
+    }
+    const allowedScopes = [
+      ...ScopeService.getBaseScopes(),
+      ...ScopeService.getRoleScopes(teamRole)
+    ];
     if (allowedScopes.includes("*")) {
       return {
         valid: true,

package/dist/lib/api/entity/generic-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic-handler.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/generic-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA8iBvD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAugBnF;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAmZrF;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CA0MpJ;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAyXtJ;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAoJtJ;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtF"}
+{"version":3,"file":"generic-handler.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/generic-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAmjBvD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAwgBnF;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAoZrF;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CA0MpJ;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CA2XtJ;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAyJtJ;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtF"}

package/dist/lib/api/entity/generic-handler.js

@@ -193,11 +193,11 @@ function getTeamIdFromRequest(request) {
 function isBuilderRequest(request) {
   return request.headers.get("x-builder-source") === "true";
 }
-async function resolveOwnershipFilter(entityConfig, userId, teamId, isBypass, authType) {
+async function resolveOwnershipFilter(entityConfig, userId, teamId, isBypass) {
   var _a;
   const ownershipFilter = (_a = entityConfig.access) == null ? void 0 : _a.ownershipFilter;
   if (!ownershipFilter) return { applies: false };
-  if (isBypass || authType === "api-key") return { applies: false };
+  if (isBypass) return { applies: false };
   const memberRow = await queryOneWithRLS(
     'SELECT role FROM "team_members" WHERE "teamId" = $1 AND "userId" = $2',
     [teamId, userId],
@@ -221,9 +221,9 @@ async function resolveOwnershipFilter(entityConfig, userId, teamId, isBypass, au
   const filterValue = linkedRow ? linkedRow[valueField] ?? null : null;
   return { applies: true, field: ownershipFilter.field, value: filterValue };
 }
-async function checkSessionPermission(authResult, entitySlug, action, teamId, request) {
+async function checkAuthPermission(authResult, entitySlug, action, teamId, request) {
   var _a;
-  if (authResult.type !== "session" || !((_a = authResult.user) == null ? void 0 : _a.id)) return null;
+  if (!((_a = authResult.user) == null ? void 0 : _a.id)) return null;
   const permission = `${entitySlug}.${action}`;
   try {
     const allowed = await checkPermission(authResult.user.id, teamId, permission);
@@ -330,7 +330,7 @@ async function handleGenericList(request) {
       teamId = teamValidation.teamId;
       isBypass = teamValidation.isBypass;
       if (!isBypass && teamId) {
-        const permDenied = await checkSessionPermission(authResult, resolution.entityConfig.slug, "list", teamId, request);
+        const permDenied = await checkAuthPermission(authResult, resolution.entityConfig.slug, "list", teamId, request);
         if (permDenied) return permDenied;
       }
     }
@@ -413,8 +413,7 @@ async function handleGenericList(request) {
         entityConfig,
         userId,
         teamId,
-        isBypass,
-        authResult.type
+        isBypass
       );
     }
     if (ownershipFilter.applies && ownershipFilter.value === null) {
@@ -714,7 +713,7 @@ async function handleGenericCreate(request) {
       const response2 = createApiError("Team context required for create operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
       return addCorsHeaders(response2, request);
     }
-    const permDenied = await checkSessionPermission(authResult, entityConfig.slug, "create", teamId, request);
+    const permDenied = await checkAuthPermission(authResult, entityConfig.slug, "create", teamId, request);
     if (permDenied) return permDenied;
     if (idStrategy === "serial") {
       insertFields = ['"userId"', '"teamId"'];
@@ -938,7 +937,7 @@ async function handleGenericRead(request, { params }) {
       teamId = teamValidation.teamId;
       isBypass = teamValidation.isBypass;
       if (!isBypass && teamId) {
-        const permDenied = await checkSessionPermission(authResult, resolution.entityConfig.slug, "read", teamId, request);
+        const permDenied = await checkAuthPermission(authResult, resolution.entityConfig.slug, "read", teamId, request);
         if (permDenied) return permDenied;
       }
     }
@@ -982,8 +981,7 @@ async function handleGenericRead(request, { params }) {
         entityConfig,
         userId,
         teamId,
-        isBypass,
-        authResult.type
+        isBypass
       );
       if (readOwnershipFilter.applies) {
         if (readOwnershipFilter.value === null) {
@@ -1045,7 +1043,7 @@ async function handleGenericRead(request, { params }) {
   }
 }
 async function handleGenericUpdate(request, { params }) {
-  var _a, _b, _c, _d, _e, _f;
+  var _a, _b, _c, _d, _e, _f, _g;
   try {
     const { id } = await params;
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
@@ -1080,7 +1078,7 @@ async function handleGenericUpdate(request, { params }) {
       const response2 = createApiError("Team context required for update operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
       return addCorsHeaders(response2, request);
     }
-    const permDenied = await checkSessionPermission(authResult, resolution.entityConfig.slug, "update", teamId, request);
+    const permDenied = await checkAuthPermission(authResult, resolution.entityConfig.slug, "update", teamId, request);
     if (permDenied) return permDenied;
     let body;
     try {
@@ -1092,7 +1090,7 @@ async function handleGenericUpdate(request, { params }) {
     const { metas, ...entityData } = body;
     const entityConfig = resolution.entityConfig;
     const fieldGuards = (_b = (_a = entityConfig.access) == null ? void 0 : _a.ownershipFilter) == null ? void 0 : _b.fieldGuards;
-    if (fieldGuards && fieldGuards.length > 0 && authResult.type === "session") {
+    if (fieldGuards && fieldGuards.length > 0 && ((_c = authResult.user) == null ? void 0 : _c.id)) {
       const guardMemberRow = await queryOneWithRLS(
         'SELECT role FROM "team_members" WHERE "teamId" = $1 AND "userId" = $2',
         [teamId, authResult.user.id],
@@ -1141,7 +1139,7 @@ async function handleGenericUpdate(request, { params }) {
     const values = [];
     let paramCount = 1;
     const builderRequest = isBuilderRequest(request);
-    const entityHasBuilder = ((_c = entityConfig.builder) == null ? void 0 : _c.enabled) === true;
+    const entityHasBuilder = ((_d = entityConfig.builder) == null ? void 0 : _d.enabled) === true;
     if (builderRequest && entityHasBuilder && "blocks" in entityData) {
       let blocksData = entityData.blocks;
       blocksData = await filterOrphanedPatternReferences(blocksData, authResult.user.id);
@@ -1217,7 +1215,7 @@ async function handleGenericUpdate(request, { params }) {
         whereConditions.push(`"teamId" = $${paramCount++}`);
         values.push(teamId);
       }
-      if (!((_d = entityConfig.access) == null ? void 0 : _d.shared)) {
+      if (!((_e = entityConfig.access) == null ? void 0 : _e.shared)) {
         whereConditions.push(`"userId" = $${paramCount++}`);
         values.push(authResult.user.id);
       }
@@ -1225,8 +1223,7 @@ async function handleGenericUpdate(request, { params }) {
         entityConfig,
         authResult.user.id,
         teamId,
-        teamValidation.isBypass,
-        authResult.type
+        teamValidation.isBypass
       );
       if (updateOwnershipFilter.applies) {
         if (updateOwnershipFilter.value === null) {
@@ -1262,7 +1259,7 @@ async function handleGenericUpdate(request, { params }) {
       }
       updatedItem = result[0];
     }
-    if ((_e = entityConfig.taxonomies) == null ? void 0 : _e.enabled) {
+    if ((_f = entityConfig.taxonomies) == null ? void 0 : _f.enabled) {
       await processTaxonomyRelations(entityConfig, id, body, authResult.user.id, true);
     }
     if (metadataWasProvided) {
@@ -1274,7 +1271,7 @@ async function handleGenericUpdate(request, { params }) {
       );
     }
     let responseItem = updatedItem;
-    if ((_f = entityConfig.taxonomies) == null ? void 0 : _f.enabled) {
+    if ((_g = entityConfig.taxonomies) == null ? void 0 : _g.enabled) {
       const itemsWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         [updatedItem],
@@ -1335,7 +1332,7 @@ async function handleGenericDelete(request, { params }) {
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse;
     }
-    if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:write`)) {
+    if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:delete`)) {
       const response2 = createApiError("Insufficient permissions", 403);
       return addCorsHeaders(response2, request);
     }
@@ -1348,7 +1345,7 @@ async function handleGenericDelete(request, { params }) {
       const response2 = createApiError("Team context required for delete operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
       return addCorsHeaders(response2, request);
     }
-    const permDenied = await checkSessionPermission(authResult, resolution.entityConfig.slug, "delete", teamId, request);
+    const permDenied = await checkAuthPermission(authResult, resolution.entityConfig.slug, "delete", teamId, request);
     if (permDenied) return permDenied;
     const entityConfig = resolution.entityConfig;
     const tableName = getTableName(entityConfig);