@nextsparkjs/core 0.1.0-beta.196 → 0.1.0-beta.197

package/README.md

@@ -19,6 +19,8 @@ pnpm db:migrate
 pnpm dev
 ```
 
+With lifecycle scripts disabled (`pnpm install --frozen-lockfile --ignore-scripts`) nothing else is needed: `nextspark dev`, `build` and `prepare` generate `src/app` and the registries. Only Cypress needs `pnpm exec cypress install` before `pnpm cy:run`.
+
 Or initialize in an existing project:
 
 ```bash

package/dist/components/auth/forms/SignupForm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignupForm.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/forms/SignupForm.tsx"],"names":[],"mappings":"AA+BA,wBAAgB,UAAU,4CAsmBzB"}
+{"version":3,"file":"SignupForm.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/forms/SignupForm.tsx"],"names":[],"mappings":"AA+BA,wBAAgB,UAAU,4CAqnBzB"}

package/dist/components/auth/forms/SignupForm.js

@@ -18,7 +18,7 @@ import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle }
 import { Separator } from "../../ui/separator.js";
 import { PasswordInput } from "../../ui/password-input.js";
 import { Mail, User, Loader2, AlertCircle, ArrowRight, MailCheck, CheckCircle2, Users } from "lucide-react";
-import { signupSchema } from "../../../lib/validation.js";
+import { inviteSignupSchema, signupSchema } from "../../../lib/validation.js";
 import { sel } from "../../../lib/selectors/auth-sel.js";
 import { useTranslations } from "next-intl";
 import { AuthTranslationPreloader } from "../../../lib/i18n/AuthTranslationPreloader.js";
@@ -43,6 +43,8 @@ function SignupForm() {
   const callbackUrl = safeCallbackPath(searchParams.get("callbackUrl"));
   const inviteToken = searchParams.get("inviteToken");
   const passwordAvailable = inviteToken ? readiness.capabilities.invitationPasswordSignup : readiness.availableMethods.includes("email-password");
+  const invitePasswordless = Boolean(inviteToken) && !passwordAvailable && readiness.capabilities.invitationSignup;
+  const formAvailable = passwordAvailable || invitePasswordless;
   const loginHref = callbackUrl ? `/login?callbackUrl=${encodeURIComponent(callbackUrl)}` : "/login";
   const {
     register,
@@ -50,7 +52,8 @@ function SignupForm() {
     watch,
     formState: { errors }
   } = useForm({
-    resolver: zodResolver(signupSchema),
+    // Without a password field the form validates the rest only
+    resolver: zodResolver(invitePasswordless ? inviteSignupSchema : signupSchema),
     defaultValues: {
       email: inviteEmail || ""
     }
@@ -75,7 +78,7 @@ function SignupForm() {
           },
           body: JSON.stringify({
             email: data.email,
-            password: data.password,
+            ...invitePasswordless ? {} : { password: data.password },
             firstName: data.firstName,
             lastName: data.lastName,
             inviteToken
@@ -100,7 +103,12 @@ function SignupForm() {
         toast.success(t("signup.messages.inviteSuccess"), {
           description: t("signup.messages.inviteJoinedTeam")
         });
-        router.push(((_a = result.data) == null ? void 0 : _a.redirectTo) || "/dashboard/settings/teams");
+        const redirectTo = ((_a = result.data) == null ? void 0 : _a.redirectTo) || "/dashboard/settings/teams";
+        if (invitePasswordless) {
+          router.push(`/login?${new URLSearchParams({ email: data.email, fromInvite: "true", callbackUrl: redirectTo })}`);
+          return;
+        }
+        router.push(redirectTo);
         return;
       }
       await signUp({
@@ -119,7 +127,7 @@ function SignupForm() {
     } finally {
       setLoadingProvider(null);
     }
-  }, [agreedToTerms, signUp, t, inviteToken, router]);
+  }, [agreedToTerms, signUp, t, inviteToken, invitePasswordless, router]);
   const handleGoogleSignUp = async () => {
     setLoadingProvider("google");
     setError(null);
@@ -147,7 +155,7 @@ function SignupForm() {
       setResendingEmail(false);
     }
   };
-  if (readiness.state === "loading" || readiness.state === "error" || readiness.state === "unavailable" && !(inviteToken && passwordAvailable)) {
+  if (readiness.state === "loading" || readiness.state === "error" || readiness.state === "unavailable" && !(inviteToken && formAvailable)) {
     const isLoading = readiness.state === "loading";
     const isError = readiness.state === "error";
     return /* @__PURE__ */ jsxs(Fragment, { children: [
@@ -341,7 +349,7 @@ function SignupForm() {
               /* @__PURE__ */ jsx(Users, { className: "h-4 w-4" }),
               /* @__PURE__ */ jsx(AlertDescription, { children: t("signup.inviteBanner") })
             ] }),
-            passwordAvailable && /* @__PURE__ */ jsxs("form", { onSubmit: handleSubmit(onSubmit), className: "space-y-4", children: [
+            formAvailable && /* @__PURE__ */ jsxs("form", { onSubmit: handleSubmit(onSubmit), className: "space-y-4", children: [
               /* @__PURE__ */ jsxs("div", { className: "grid gap-4 sm:grid-cols-2", children: [
                 /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
                   /* @__PURE__ */ jsx(Label, { htmlFor: "firstName", children: t("signup.form.firstName") }),
@@ -402,41 +410,43 @@ function SignupForm() {
                 ] }),
                 errors.email && /* @__PURE__ */ jsx("p", { className: "text-sm text-destructive", children: errors.email.message })
               ] }),
-              /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
-                /* @__PURE__ */ jsx(Label, { htmlFor: "password", children: t("signup.form.password") }),
-                /* @__PURE__ */ jsx(
-                  PasswordInput,
-                  {
-                    ...register("password"),
-                    id: "password",
-                    autoComplete: "new-password",
-                    placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
-                    showRequirements: true,
-                    password,
-                    requirementLabels: {
-                      minChars: t("signup.form.passwordRequirements.minChars"),
-                      uppercase: t("signup.form.passwordRequirements.uppercase"),
-                      lowercase: t("signup.form.passwordRequirements.lowercase"),
-                      number: t("signup.form.passwordRequirements.number")
-                    },
-                    "data-cy": sel("auth.signup.password")
-                  }
-                ),
-                errors.password && /* @__PURE__ */ jsx("p", { className: "text-sm text-destructive", children: errors.password.message })
-              ] }),
-              /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
-                /* @__PURE__ */ jsx(Label, { htmlFor: "confirmPassword", children: t("signup.form.confirmPassword") }),
-                /* @__PURE__ */ jsx(
-                  PasswordInput,
-                  {
-                    ...register("confirmPassword"),
-                    id: "confirmPassword",
-                    autoComplete: "new-password",
-                    placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
-                    "data-cy": sel("auth.signup.confirmPassword")
-                  }
-                ),
-                errors.confirmPassword && /* @__PURE__ */ jsx("p", { className: "text-sm text-destructive", children: errors.confirmPassword.message })
+              !invitePasswordless && /* @__PURE__ */ jsxs(Fragment, { children: [
+                /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+                  /* @__PURE__ */ jsx(Label, { htmlFor: "password", children: t("signup.form.password") }),
+                  /* @__PURE__ */ jsx(
+                    PasswordInput,
+                    {
+                      ...register("password"),
+                      id: "password",
+                      autoComplete: "new-password",
+                      placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
+                      showRequirements: true,
+                      password,
+                      requirementLabels: {
+                        minChars: t("signup.form.passwordRequirements.minChars"),
+                        uppercase: t("signup.form.passwordRequirements.uppercase"),
+                        lowercase: t("signup.form.passwordRequirements.lowercase"),
+                        number: t("signup.form.passwordRequirements.number")
+                      },
+                      "data-cy": sel("auth.signup.password")
+                    }
+                  ),
+                  errors.password && /* @__PURE__ */ jsx("p", { className: "text-sm text-destructive", children: errors.password.message })
+                ] }),
+                /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+                  /* @__PURE__ */ jsx(Label, { htmlFor: "confirmPassword", children: t("signup.form.confirmPassword") }),
+                  /* @__PURE__ */ jsx(
+                    PasswordInput,
+                    {
+                      ...register("confirmPassword"),
+                      id: "confirmPassword",
+                      autoComplete: "new-password",
+                      placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
+                      "data-cy": sel("auth.signup.confirmPassword")
+                    }
+                  ),
+                  errors.confirmPassword && /* @__PURE__ */ jsx("p", { className: "text-sm text-destructive", children: errors.confirmPassword.message })
+                ] })
               ] }),
               error && /* @__PURE__ */ jsxs(Alert, { variant: "destructive", "data-cy": sel("auth.signup.error"), children: [
                 /* @__PURE__ */ jsx(AlertCircle, { className: "h-4 w-4" }),
@@ -479,7 +489,7 @@ function SignupForm() {
                 }
               )
             ] }),
-            !passwordAvailable && !googleAvailable && /* @__PURE__ */ jsxs(
+            !formAvailable && !googleAvailable && /* @__PURE__ */ jsxs(
               Alert,
               {
                 role: "alert",
@@ -495,12 +505,12 @@ function SignupForm() {
                 ]
               }
             ),
-            inviteToken && !passwordAvailable && googleAvailable && /* @__PURE__ */ jsxs(Alert, { role: "alert", className: "mb-4", "data-cy": sel("auth.signup.inviteUnavailable"), children: [
+            inviteToken && !formAvailable && googleAvailable && /* @__PURE__ */ jsxs(Alert, { role: "alert", className: "mb-4", "data-cy": sel("auth.signup.inviteUnavailable"), children: [
               /* @__PURE__ */ jsx(AlertCircle, { className: "h-4 w-4", "aria-hidden": "true" }),
               /* @__PURE__ */ jsx(AlertDescription, { children: t("signup.inviteUnavailable") })
             ] }),
             googleAvailable && /* @__PURE__ */ jsxs(Fragment, { children: [
-              passwordAvailable && /* @__PURE__ */ jsxs("div", { className: "relative my-4", children: [
+              formAvailable && /* @__PURE__ */ jsxs("div", { className: "relative my-4", children: [
                 /* @__PURE__ */ jsx("div", { className: "absolute inset-0 flex items-center", children: /* @__PURE__ */ jsx(Separator, { className: "w-full" }) }),
                 /* @__PURE__ */ jsx("div", { className: "relative flex justify-center text-xs uppercase", children: /* @__PURE__ */ jsx("span", { className: "bg-background px-2 text-muted-foreground", children: t("signup.form.orContinueWith") }) })
               ] }),

package/dist/components/dashboard/block-editor/config-panel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-panel.d.ts","sourceRoot":"","sources":["../../../../src/components/dashboard/block-editor/config-panel.tsx"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAA;AACxF,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,uBAAuB,CAAA;AAkB1E,UAAU,gBAAgB;IACxB,YAAY,EAAE,kBAAkB,CAAA;IAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACrC,mBAAmB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,oBAAoB,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAA;CACvD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAC1B,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACrB,EAAE,gBAAgB,2CA6elB"}
+{"version":3,"file":"config-panel.d.ts","sourceRoot":"","sources":["../../../../src/components/dashboard/block-editor/config-panel.tsx"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAA;AACxF,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,uBAAuB,CAAA;AAmB1E,UAAU,gBAAgB;IACxB,YAAY,EAAE,kBAAkB,CAAA;IAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACrC,mBAAmB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,oBAAoB,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAA;CACvD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAC1B,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACrB,EAAE,gBAAgB,2CA6elB"}

package/dist/components/dashboard/block-editor/config-panel.js

@@ -36,7 +36,8 @@ import {
   SelectTrigger,
   SelectValue
 } from "../../ui/select.js";
-import { withBasePath, withBasePathIfInApp } from "../../../lib/base-path.js";
+import { withBasePathIfInApp } from "../../../lib/base-path.js";
+import { fetchWithTeam } from "../../../lib/api/entities.js";
 function ConfigPanel({
   entityConfig,
   entityFields,
@@ -59,7 +60,7 @@ function ConfigPanel({
     queryKey: ["taxonomies", taxonomyApiPath],
     queryFn: async () => {
       if (!taxonomyApiPath) return { data: [] };
-      const response = await fetch(withBasePath(`/api/v1/${taxonomyApiPath}`));
+      const response = await fetchWithTeam(`/api/v1/${taxonomyApiPath}`);
       if (!response.ok) return { data: [] };
       return response.json();
     },

package/dist/components/dashboard/block-editor/entity-fields-sidebar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-fields-sidebar.d.ts","sourceRoot":"","sources":["../../../../src/components/dashboard/block-editor/entity-fields-sidebar.tsx"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAA;AAkBxF,UAAU,wBAAwB;IAChC,YAAY,EAAE,kBAAkB,CAAA;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IACjD,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAA;CAChD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,kBAAuB,EACvB,gBAAgB,EACjB,EAAE,wBAAwB,2CAmS1B"}
+{"version":3,"file":"entity-fields-sidebar.d.ts","sourceRoot":"","sources":["../../../../src/components/dashboard/block-editor/entity-fields-sidebar.tsx"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAA;AAmBxF,UAAU,wBAAwB;IAChC,YAAY,EAAE,kBAAkB,CAAA;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IACjD,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAA;CAChD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,kBAAuB,EACvB,gBAAgB,EACjB,EAAE,wBAAwB,2CAmS1B"}

package/dist/components/dashboard/block-editor/entity-fields-sidebar.js

@@ -18,7 +18,8 @@ import {
   SelectTrigger,
   SelectValue
 } from "../../ui/select.js";
-import { withBasePath, withBasePathIfInApp } from "../../../lib/base-path.js";
+import { withBasePathIfInApp } from "../../../lib/base-path.js";
+import { fetchWithTeam } from "../../../lib/api/entities.js";
 function EntityFieldsSidebar({
   entityConfig,
   fields,
@@ -37,7 +38,7 @@ function EntityFieldsSidebar({
     queryKey: ["taxonomies", taxonomyApiPath],
     queryFn: async () => {
       if (!taxonomyApiPath) return { data: [] };
-      const response = await fetch(withBasePath(`/api/v1/${taxonomyApiPath}`));
+      const response = await fetchWithTeam(`/api/v1/${taxonomyApiPath}`);
       if (!response.ok) return { data: [] };
       return response.json();
     },

package/dist/components/users/tables/UsersTable.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UsersTable.d.ts","sourceRoot":"","sources":["../../../../src/components/users/tables/UsersTable.tsx"],"names":[],"mappings":"AAsCA,OAAO,EAEL,IAAI,EAUL,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAM1D,UAAU,IAAI;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,eAAe;IACvB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AASD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,eAAe,2CA2Y1E"}
+{"version":3,"file":"UsersTable.d.ts","sourceRoot":"","sources":["../../../../src/components/users/tables/UsersTable.tsx"],"names":[],"mappings":"AAsCA,OAAO,EAEL,IAAI,EAUL,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAM1D,UAAU,IAAI;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,eAAe;IACvB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AASD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,eAAe,2CAwY1E"}

package/dist/components/users/tables/UsersTable.js

@@ -183,9 +183,9 @@ function UsersTable({ users, isLoading, onRefresh }) {
   };
   const getRoleBadgeVariant = (role) => {
     switch (role) {
-      case "admin":
+      case "suspended":
         return "destructive";
-      case "colaborator":
+      case "developer":
         return "default";
       case "member":
         return "secondary";
@@ -284,8 +284,7 @@ function UsersTable({ users, isLoading, onRefresh }) {
                       onValueChange: (value) => handleRoleChange(user, value),
                       children: [
                         /* @__PURE__ */ jsx(DropdownMenuRadioItem, { value: "member", children: "Member" }),
-                        /* @__PURE__ */ jsx(DropdownMenuRadioItem, { value: "colaborator", children: "Colaborator" }),
-                        /* @__PURE__ */ jsx(DropdownMenuRadioItem, { value: "admin", children: "Admin" })
+                        /* @__PURE__ */ jsx(DropdownMenuRadioItem, { value: "developer", children: "Developer" })
                       ]
                     }
                   ) })

package/dist/hooks/useAuthReadiness.d.ts

@@ -2,6 +2,7 @@ import type { AuthLoginMethod } from '../lib/config/types';
 export type AuthReadinessState = 'loading' | 'ready' | 'unavailable' | 'error';
 /** Server-derived flows independent of the login UI methods; see runtime-readiness. */
 export interface ClientAuthCapabilities {
+    invitationSignup: boolean;
     invitationPasswordSignup: boolean;
     passwordRecovery: boolean;
 }

package/dist/hooks/useAuthReadiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthReadiness.d.ts","sourceRoot":"","sources":["../../src/hooks/useAuthReadiness.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAE1D,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,GAAG,aAAa,GAAG,OAAO,CAAA;AAE9E,uFAAuF;AACvF,MAAM,WAAW,sBAAsB;IACrC,wBAAwB,EAAE,OAAO,CAAA;IACjC,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,kBAAkB,CAAA;IACzB,gBAAgB,EAAE,eAAe,EAAE,CAAA;IACnC,YAAY,EAAE,sBAAsB,CAAA;CACrC;AAsCD,qFAAqF;AACrF,wBAAgB,gBAAgB,IAAI,mBAAmB,CA8BtD"}
+{"version":3,"file":"useAuthReadiness.d.ts","sourceRoot":"","sources":["../../src/hooks/useAuthReadiness.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAE1D,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,GAAG,aAAa,GAAG,OAAO,CAAA;AAE9E,uFAAuF;AACvF,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,EAAE,OAAO,CAAA;IACzB,wBAAwB,EAAE,OAAO,CAAA;IACjC,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,kBAAkB,CAAA;IACzB,gBAAgB,EAAE,eAAe,EAAE,CAAA;IACnC,YAAY,EAAE,sBAAsB,CAAA;CACrC;AAyCD,qFAAqF;AACrF,wBAAgB,gBAAgB,IAAI,mBAAmB,CA8BtD"}

package/dist/hooks/useAuthReadiness.js

@@ -3,6 +3,7 @@ import { useEffect, useState } from "react";
 import { withBasePath } from "../lib/base-path.js";
 import { isAuthLoginMethod } from "../lib/auth/auth-methods.js";
 const NO_CAPABILITIES = {
+  invitationSignup: false,
   invitationPasswordSignup: false,
   passwordRecovery: false
 };
@@ -19,13 +20,14 @@ function parseReadiness(value) {
     throw new Error("Ready auth response has no available method");
   }
   const capabilities = candidate.capabilities;
-  if (!capabilities || typeof capabilities !== "object" || typeof capabilities.invitationPasswordSignup !== "boolean" || typeof capabilities.passwordRecovery !== "boolean") {
+  if (!capabilities || typeof capabilities !== "object" || typeof capabilities.invitationSignup !== "boolean" || typeof capabilities.invitationPasswordSignup !== "boolean" || typeof capabilities.passwordRecovery !== "boolean") {
     throw new Error("Invalid auth readiness capabilities");
   }
   return {
     state: candidate.status,
     availableMethods: [...new Set(candidate.availableMethods)],
     capabilities: {
+      invitationSignup: capabilities.invitationSignup,
       invitationPasswordSignup: capabilities.invitationPasswordSignup,
       passwordRecovery: capabilities.passwordRecovery
     }

package/dist/lib/actions/entity.actions.js

@@ -6,12 +6,12 @@ import { ACTIVE_TEAM_COOKIE, activeTeamIdForSession } from "../teams/active-team
 import { redirect } from "next/navigation";
 import { GenericEntityService } from "../services/generic-entity.service.js";
 import { entityRegistry } from "../entities/registry.js";
-import { getTypedSession } from "../auth.js";
+import { getAuthorizationSession } from "../auth/authorization-session.js";
 import { checkPermission } from "../permissions/check.js";
 async function getAuthContext() {
   var _a, _b, _c;
   const headersList = await headers();
-  const session = await getTypedSession(headersList);
+  const session = await getAuthorizationSession(headersList);
   if (!((_a = session == null ? void 0 : session.user) == null ? void 0 : _a.id)) {
     return { success: false, error: "Authentication required" };
   }

package/dist/lib/actions/team.actions.js

@@ -1,7 +1,7 @@
 "use server";
 import { revalidatePath } from "next/cache";
 import { headers } from "next/headers";
-import { getTypedSession } from "../auth.js";
+import { getAuthorizationSession } from "../auth/authorization-session.js";
 import { TeamService } from "../services/team.service.js";
 import { TeamMemberService } from "../services/team-member.service.js";
 import { getInvitableRoles } from "../teams/permissions.js";
@@ -9,7 +9,7 @@ import { APP_CONFIG_MERGED } from "../config/config-sync.js";
 async function getAuthUser() {
   var _a;
   const headersList = await headers();
-  const session = await getTypedSession(headersList);
+  const session = await getAuthorizationSession(headersList);
   if (!((_a = session == null ? void 0 : session.user) == null ? void 0 : _a.id)) {
     return { success: false, error: "Authentication required" };
   }

package/dist/lib/actions/user.actions.js

@@ -1,13 +1,13 @@
 "use server";
 import { revalidatePath } from "next/cache";
 import { headers } from "next/headers";
-import { getTypedSession } from "../auth.js";
+import { getAuthorizationSession } from "../auth/authorization-session.js";
 import { UserService } from "../services/user.service.js";
 async function updateProfile(data) {
   var _a;
   try {
     const headersList = await headers();
-    const session = await getTypedSession(headersList);
+    const session = await getAuthorizationSession(headersList);
     if (!((_a = session == null ? void 0 : session.user) == null ? void 0 : _a.id)) {
       return { success: false, error: "Authentication required" };
     }
@@ -54,7 +54,7 @@ async function updateAvatar(formData) {
   var _a;
   try {
     const headersList = await headers();
-    const session = await getTypedSession(headersList);
+    const session = await getAuthorizationSession(headersList);
     if (!((_a = session == null ? void 0 : session.user) == null ? void 0 : _a.id)) {
       return { success: false, error: "Authentication required" };
     }
@@ -109,7 +109,7 @@ async function deleteAccount() {
   var _a;
   try {
     const headersList = await headers();
-    const session = await getTypedSession(headersList);
+    const session = await getAuthorizationSession(headersList);
     if (!((_a = session == null ? void 0 : session.user) == null ? void 0 : _a.id)) {
       return { success: false, error: "Authentication required" };
     }

package/dist/lib/api/auth/dual-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dual-auth.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/dual-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAOvD,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EAKrB,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAK/F;;;GAGG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAA;AAExD;;GAEG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAA;AACnD,eAAO,MAAM,kBAAkB,8BAA8B,CAAA;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAA;AAOjD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAA;IACpC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,mHAAmH;IACnH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+GAA+G;IAC/G,iBAAiB,CAAC,EAAE,QAAQ,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3D,0EAA0E;IAC1E,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,cAAc,CAAC,CA2DzB;AAmKD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAUtG;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,CAsChC;AAMD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,cAAc,EAC1B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AA2BD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,MAAkC,EAAE,MAAM,GAAE,MAAY;;;;GAShG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,cAAc,GAAG,YAAY,CAWlF"}
+{"version":3,"file":"dual-auth.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/dual-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAQvD,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EAKrB,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAK/F;;;GAGG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAA;AAExD;;GAEG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAA;AACnD,eAAO,MAAM,kBAAkB,8BAA8B,CAAA;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAA;AAOjD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAA;IACpC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,mHAAmH;IACnH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+GAA+G;IAC/G,iBAAiB,CAAC,EAAE,QAAQ,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3D,0EAA0E;IAC1E,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,cAAc,CAAC,CA2DzB;AAsKD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAUtG;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,CAsChC;AAMD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,cAAc,EAC1B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AA2BD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,MAAkC,EAAE,MAAM,GAAE,MAAY;;;;GAShG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,cAAc,GAAG,YAAY,CAWlF"}

package/dist/lib/api/auth/dual-auth.js

@@ -3,6 +3,7 @@ import { getUserDefaultTeamId } from "../../teams/dashboard-team.js";
 import { NextResponse } from "next/server";
 import { auth } from "../../auth.js";
 import { validateApiKey } from "../auth.js";
+import { isSuspendedRole } from "../../auth/suspension.js";
 import { apiKeyRateLimitResponse } from "../rate-limit.js";
 import { queryOne } from "../../db.js";
 import { TeamMemberService } from "../../services/team-member.service.js";
@@ -141,8 +142,8 @@ async function tryApiKeyAuth(request) {
 async function trySessionAuth(request) {
   var _a;
   try {
-    const session = await auth.api.getSession({ headers: request.headers });
-    if (!(session == null ? void 0 : session.user)) {
+    const session = await auth.api.getSession({ headers: request.headers, query: { disableCookieCache: true } });
+    if (!(session == null ? void 0 : session.user) || isSuspendedRole(session.user.role)) {
       return { success: false, type: "none", user: null };
     }
     const defaultTeamId = await getUserDefaultTeamId(session.user.id);

package/dist/lib/api/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD,6FAA6F;AAC7F,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAEtE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA0GrF;AA8CD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5E;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAM/E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhF;AAiBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU;QAG1C,MAAM;WACH,MAAM;eACF,MAAM,GAAG,IAAI;cACd,MAAM,GAAG,IAAI;UACjB,MAAM;GAWjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAyED"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD,6FAA6F;AAC7F,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAEtE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAsHrF;AA8CD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5E;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAM/E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhF;AAiBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU;QAG1C,MAAM;WACH,MAAM;eACF,MAAM,GAAG,IAAI;cACd,MAAM,GAAG,IAAI;UACjB,MAAM;GAWjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAyED"}

package/dist/lib/api/auth.js

@@ -11,6 +11,8 @@ function getValidatedApiKey(request) {
   return validatedKeys.get(request) ?? null;
 }
 async function validateApiKey(request) {
+  const validatedBefore = validatedKeys.get(request);
+  if (validatedBefore) return validatedBefore;
   const startTime = Date.now();
   try {
     const apiKey = presentedApiKey(request.headers);
@@ -63,6 +65,11 @@ async function validateApiKey(request) {
       await constantTimeDelay(startTime);
       return null;
     }
+    const owner = await queryOne('SELECT role FROM "users" WHERE id = $1', [keyData.userId]);
+    if ((owner == null ? void 0 : owner.role) === "suspended") {
+      await constantTimeDelay(startTime);
+      return null;
+    }
     if (keyData.failedAttempts && keyData.failedAttempts > 0) {
       resetFailedAttempts(keyData.id).catch(console.error);
     }

package/dist/lib/api/entity/generic-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic-handler.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/generic-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA4wBvD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEnF;AA8lBD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAErF;AAyaD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEpJ;AAoND;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AA6ZD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AAwKD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtF"}
+{"version":3,"file":"generic-handler.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/generic-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA+wBvD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEnF;AA8lBD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAErF;AAwcD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEpJ;AAoND;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AA4bD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AAwKD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtF"}

package/dist/lib/api/entity/generic-handler.js

@@ -5,7 +5,7 @@ import { generateEntitySchemas } from "../../entities/schema-generator.js";
 import { publicSlugIssue, otherBasePathSegments } from "../../entities/public-slug.js";
 import { getAllEntityConfigs } from "../../entities/registry.js";
 import { entityResponseSystemColumns, taxonomyResponseFields } from "../../entities/portable/response-shape.js";
-import { queryWithRLS, mutateWithRLS, queryOneWithRLS } from "../../db.js";
+import { queryWithRLS, mutateWithRLS, queryOneWithRLS, getTransactionClient } from "../../db.js";
 import {
   createApiResponse,
   createApiError,
@@ -22,7 +22,7 @@ import {
 } from "../helpers.js";
 import { beforeEntityCreate, afterEntityCreate, beforeEntityUpdate, afterEntityUpdate, beforeEntityDelete, afterEntityDelete, beforeEntityRead, afterEntityRead } from "../../entities/entity-hooks.js";
 import { logGenericHandlerUsage } from "./audit-log.js";
-import { checkPermission } from "../../permissions/check.js";
+import { checkPermission, declaredPublishPermission, publishPermissionFor } from "../../permissions/check.js";
 import { extractPatternIds } from "../../blocks/pattern-resolver.js";
 import { isPatternReference } from "../../../types/pattern-reference.js";
 import { PatternUsageService } from "../../services/pattern-usage.service.js";
@@ -122,7 +122,7 @@ async function includeTaxonomiesInData(entityConfig, items, userId) {
     };
   });
 }
-async function processTaxonomyRelations(entityConfig, entityId, data, userId, isUpdate = false) {
+async function processTaxonomyRelations(entityConfig, entityId, data, userId, teamId, isUpdate = false) {
   var _a, _b, _c;
   if (!((_a = entityConfig.taxonomies) == null ? void 0 : _a.enabled) || !((_c = (_b = entityConfig.taxonomies) == null ? void 0 : _b.types) == null ? void 0 : _c.length)) {
     return;
@@ -146,8 +146,9 @@ async function processTaxonomyRelations(entityConfig, entityId, data, userId, is
         const taxonomyId = typeof taxonomyIds[i] === "object" && taxonomyIds[i] !== null ? taxonomyIds[i].id : taxonomyIds[i];
         await mutateWithRLS(
           `INSERT INTO entity_taxonomy_relations ("entityType", "entityId", "taxonomyId", "order")
-           VALUES ($1, $2, $3, $4)`,
-          [entityType, entityId, taxonomyId, i + 1],
+           SELECT $1, $2, id, $4 FROM taxonomies
+           WHERE id = $3 AND type = $5 AND ("teamId" IS NULL OR "teamId" = $6)`,
+          [entityType, entityId, taxonomyId, i + 1, taxonomyType.type, teamId],
           userId
         );
       }
@@ -785,7 +786,7 @@ async function handleGenericCreate(request) {
   return runWithAuditLog(request, (audit) => handleGenericCreateImpl(request, audit));
 }
 async function handleGenericCreateImpl(request, audit) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
   try {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
@@ -886,6 +887,13 @@ async function handleGenericCreateImpl(request, audit) {
       );
       return addCorsHeaders(response2, request);
     }
+    const createStatusField = entityConfig.fields.find((f) => f.name === "status");
+    const createStatus = validatedData.status ?? (createStatusField == null ? void 0 : createStatusField.defaultValue);
+    if (publishPermissionFor(entityConfig.slug, createStatus)) {
+      const publishDenied = await checkAuthPermission(authResult, entityConfig.slug, "publish", teamId, request);
+      if (publishDenied) return publishDenied;
+    }
+    const checkStoredStatus = createStatus === void 0 && !!createStatusField && !!declaredPublishPermission(entityConfig.slug);
     if (idStrategy === "serial") {
       insertFields = ['"userId"', '"teamId"'];
       placeholders = ["$1", "$2"];
@@ -984,8 +992,28 @@ async function handleGenericCreateImpl(request, audit) {
       INSERT INTO "${tableName}" (${insertFields.join(", ")})
       VALUES (${placeholders.join(", ")}) RETURNING *
     `;
-    const insertResult = await mutateWithRLS(insertQuery, values, authResult.user.id);
-    const createdEntityId = String((_g = insertResult.rows[0]) == null ? void 0 : _g.id);
+    let insertResult;
+    if (checkStoredStatus) {
+      const tx = await getTransactionClient(authResult.user.id);
+      try {
+        insertResult = await tx.mutate(insertQuery, values);
+        if (((_g = insertResult.rows[0]) == null ? void 0 : _g.status) === "published") {
+          const publishDenied = await checkAuthPermission(authResult, entityConfig.slug, "publish", teamId, request);
+          if (publishDenied) {
+            await tx.rollback();
+            return publishDenied;
+          }
+        }
+        await tx.commit();
+      } catch (error) {
+        await tx.rollback().catch(() => {
+        });
+        throw error;
+      }
+    } else {
+      insertResult = await mutateWithRLS(insertQuery, values, authResult.user.id);
+    }
+    const createdEntityId = String((_h = insertResult.rows[0]) == null ? void 0 : _h.id);
     if (limitSlug) {
       UsageService.track({
         teamId,
@@ -1015,8 +1043,8 @@ async function handleGenericCreateImpl(request, audit) {
     `;
     const createdItems = await queryWithRLS(selectQuery, [createdEntityId], authResult.user.id);
     const createdItem = createdItems[0];
-    if ((_h = entityConfig.taxonomies) == null ? void 0 : _h.enabled) {
-      await processTaxonomyRelations(entityConfig, createdEntityId, body, authResult.user.id, false);
+    if ((_i = entityConfig.taxonomies) == null ? void 0 : _i.enabled) {
+      await processTaxonomyRelations(entityConfig, createdEntityId, body, authResult.user.id, teamId, false);
     }
     const metadataWasProvided = metas && typeof metas === "object" && Object.keys(metas).length > 0;
     if (metadataWasProvided) {
@@ -1028,7 +1056,7 @@ async function handleGenericCreateImpl(request, audit) {
       );
     }
     let responseItem = createdItem;
-    if ((_i = entityConfig.taxonomies) == null ? void 0 : _i.enabled) {
+    if ((_j = entityConfig.taxonomies) == null ? void 0 : _j.enabled) {
       const itemsWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         [createdItem],
@@ -1327,6 +1355,18 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
       );
       return addCorsHeaders(response2, request);
     }
+    let statusRead;
+    if ("status" in entityData && entityConfig.fields.some((f) => f.name === "status") && declaredPublishPermission(entityConfig.slug)) {
+      statusRead = (await queryWithRLS(
+        `SELECT "status" FROM "${tableName}" WHERE id = $1 AND "teamId" = $2`,
+        [id, teamId],
+        authResult.user.id
+      ))[0];
+      if (statusRead && publishPermissionFor(entityConfig.slug, validatedData.status, statusRead.status)) {
+        const publishDenied = await checkAuthPermission(authResult, entityConfig.slug, "publish", teamId, request);
+        if (publishDenied) return publishDenied;
+      }
+    }
     const updates = [];
     const values = [];
     let paramCount = 1;
@@ -1425,6 +1465,10 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
         whereConditions.push(`"${updateOwnershipFilter.field}" = $${paramCount++}`);
         values.push(updateOwnershipFilter.value);
       }
+      if (statusRead) {
+        whereConditions.push(`"status" IS NOT DISTINCT FROM $${paramCount++}`);
+        values.push(statusRead.status);
+      }
       const updateQuery = `
         UPDATE "${tableName}"
         SET ${updates.join(", ")}
@@ -1433,6 +1477,16 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
       `;
       const result = await mutateWithRLS(updateQuery, values, authResult.user.id);
       if (!result.rows || result.rows.length === 0) {
+        if (statusRead) {
+          const [now] = await queryWithRLS(
+            `SELECT "status" FROM "${tableName}" WHERE id = $1 AND "teamId" = $2`,
+            [id, teamId],
+            authResult.user.id
+          );
+          if (now && now.status !== statusRead.status) {
+            return addCorsHeaders(createApiError("The record changed while it was being saved. Reload it and try again.", 409, void 0, "STATUS_CHANGED"), request);
+          }
+        }
         const response2 = createApiError("Item not found", 404);
         return addCorsHeaders(response2, request);
       }
@@ -1452,7 +1506,7 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
       updatedItem = result[0];
     }
     if ((_g = entityConfig.taxonomies) == null ? void 0 : _g.enabled) {
-      await processTaxonomyRelations(entityConfig, id, body, authResult.user.id, true);
+      await processTaxonomyRelations(entityConfig, id, body, authResult.user.id, teamId, true);
     }
     if (metadataWasProvided) {
       await processEntityMetadata(