@niledatabase/server 3.0.0-alpha.0 → 3.0.0-alpha.10

package/dist/server.cjs.development.js

@@ -3,8 +3,8 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 require('dotenv/config');
-var jose = require('jose');
 var pg = require('pg');
+var jose = require('jose');
 
 function _regeneratorRuntime() {
   _regeneratorRuntime = function () {
@@ -609,11 +609,19 @@ var getControlPlane = function getControlPlane(cfg) {
     logger = cfg.logger;
   var _Logger9 = Logger(config, '[basePath]'),
     info = _Logger9.info;
+  if (config != null && config.configureUrl) {
+    logger && info(logger, 'config', config.configureUrl);
+    return config.configureUrl;
+  }
   if (process.env.NILEDB_CONFIGURE) {
     logger && info(logger, 'NILEDB_CONFIGURE', process.env.NILEDB_CONFIGURE);
+    // backwards compatible, but not really
+    if (!process.env.NILEDB_CONFIGURE.startsWith('http')) {
+      return "https://" + process.env.NILEDB_CONFIGURE;
+    }
     return process.env.NILEDB_CONFIGURE;
   }
-  logger && info(logger, 'default', process.env.NILEDB_CONFIGURE);
+  logger && info(logger, 'default', 'https://global.thenile.dev');
   return 'https://global.thenile.dev';
 };
 function getDbHost(cfg) {
@@ -899,11 +907,6 @@ var Config = /*#__PURE__*/function () {
   }]);
 }();
 
-var ResponseError = function ResponseError(body, init) {
-  this.response = void 0;
-  this.response = new Response(body, init);
-};
-
 var Events;
 (function (Events) {
   Events["User"] = "userId";
@@ -974,886 +977,179 @@ var evictPool = function evictPool(val) {
   eventer.publish(Events.EvictPool, val);
 };
 
-var X_NILE_TENANT = 'niledb-tenant-id';
-var X_NILE_USER_ID = 'niledb-user-id';
-function getTokenFromCookie(headers, cookieKey) {
-  var _headers$get;
-  var cookie = (_headers$get = headers.get('cookie')) == null ? void 0 : _headers$get.split('; ');
-  var _cookies = {};
-  if (cookie) {
-    for (var _iterator = _createForOfIteratorHelperLoose(cookie), _step; !(_step = _iterator()).done;) {
-      var parts = _step.value;
-      var cookieParts = parts.split('=');
-      var _cookie = cookieParts.slice(1).join('=');
-      var name = cookieParts[0];
-      _cookies[name] = _cookie;
-    }
-  }
-  if (cookie) {
-    for (var _iterator2 = _createForOfIteratorHelperLoose(cookie), _step2; !(_step2 = _iterator2()).done;) {
-      var _parts = _step2.value;
-      var _cookieParts = _parts.split('=');
-      var _cookie2 = _cookieParts.slice(1).join('=');
-      var _name = _cookieParts[0];
-      _cookies[_name] = _cookie2;
+function createProxyForPool(pool, config) {
+  var _Logger = Logger(config, '[pool]'),
+    info = _Logger.info,
+    error = _Logger.error;
+  return new Proxy(pool, {
+    get: function get(target, property) {
+      if (property === 'query') {
+        // give connection string a pass for these problems
+        if (!config.db.connectionString) {
+          if (!config.user || !config.password) {
+            error('Cannot connect to the database. User and/or password are missing. Generate them at https://console.thenile.dev');
+          } else if (!config.db.database) {
+            error('Database name is missing from the config. Call `nile.init()` or set NILEDB_ID in your .env');
+          }
+        }
+        var caller = target[property];
+        return function query() {
+          for (var _len = arguments.length, args = new Array(_len), _key = 0; _key < _len; _key++) {
+            args[_key] = arguments[_key];
+          }
+          info.apply(void 0, args);
+          // @ts-expect-error - not mine
+          var called = caller.apply(this, args);
+          return called;
+        };
+      }
+      return target[property];
     }
-  }
-  if (cookieKey) {
-    return _cookies[cookieKey];
-  }
-  return null;
-}
-function getTenantFromHttp(headers, config) {
-  var _ref;
-  var cookieTenant = getTokenFromCookie(headers, X_NILE_TENANT);
-  return (_ref = cookieTenant != null ? cookieTenant : headers == null ? void 0 : headers.get(X_NILE_TENANT)) != null ? _ref : config == null ? void 0 : config.tenantId;
+  });
 }
-function getUserFromHttp(headers, config) {
-  var _headers$get2;
-  var token = getTokenFromCookie(headers, config.api.cookieKey);
-  if (token) {
-    var jwt = jose.decodeJwt(token);
-    return jwt.sub;
+
+function isUUID(value) {
+  if (!value) {
+    return false;
   }
-  return (_headers$get2 = headers == null ? void 0 : headers.get(X_NILE_USER_ID)) != null ? _headers$get2 : config.userId;
-}
-function _fetch(_x, _x2, _x3) {
-  return _fetch2.apply(this, arguments);
+  var regex = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+  return regex.test(value);
 }
-function _fetch2() {
-  _fetch2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(config, path, opts) {
-    var _config$api, _config$api2, _response$status;
-    var _Logger, info, error, url, cookieKey, headers, basicHeaders, creds, authHeader, token, tenantId, userId, useableUrl, response, res, errorHandler, msg, _res, message, _res2, _res2$errors, _message;
-    return _regeneratorRuntime().wrap(function _callee$(_context) {
-      while (1) switch (_context.prev = _context.next) {
-        case 0:
-          _Logger = Logger(config, '[server]'), info = _Logger.info, error = _Logger.error;
-          url = "" + ((_config$api = config.api) == null ? void 0 : _config$api.basePath) + path;
-          cookieKey = (_config$api2 = config.api) == null ? void 0 : _config$api2.cookieKey;
-          headers = new Headers(opts == null ? void 0 : opts.headers);
-          basicHeaders = new Headers(opts == null ? void 0 : opts.headers);
-          basicHeaders.set('content-type', 'application/json; charset=utf-8');
-          creds = Buffer.from(process.env.NILEDB_USER + ":" + process.env.NILEDB_PASSWORD, 'utf8').toString('base64');
-          basicHeaders.set('niledb-creds', creds);
-          authHeader = headers.get('Authorization');
-          if (!authHeader) {
-            token = getTokenFromCookie(headers, cookieKey);
-            if (token) {
-              basicHeaders.set('Authorization', "Bearer " + token);
-            } else if (getToken({
-              config: config
-            })) {
-              basicHeaders.set('Authorization', "Bearer " + getToken({
-                config: config
-              }));
-            }
-          }
-          tenantId = getTenantFromHttp(headers, config);
-          updateTenantId(tenantId);
-          userId = getUserFromHttp(headers, config);
-          updateUserId(userId);
-          if (!(url.includes('{tenantId}') && !tenantId)) {
-            _context.next = 16;
-            break;
-          }
-          return _context.abrupt("return", new ResponseError('tenantId is not set for request', {
-            status: 400
-          }));
-        case 16:
-          useableUrl = url.replace('{tenantId}', encodeURIComponent(String(tenantId))).replace('{userId}', encodeURIComponent(String(userId)));
-          info('[fetch]', useableUrl);
-          _context.next = 20;
-          return fetch(useableUrl, _extends({}, opts, {
-            headers: basicHeaders
-          }))["catch"](function (e) {
-            error('[fetch]', '[response]', e);
-          });
-        case 20:
-          response = _context.sent;
-          if (!(response && response.status >= 200 && response.status < 300)) {
-            _context.next = 39;
-            break;
-          }
-          if (!(typeof response.clone === 'function')) {
-            _context.next = 38;
-            break;
-          }
-          _context.prev = 23;
-          _context.t0 = info;
-          _context.next = 27;
-          return response.clone().json();
-        case 27:
-          _context.t1 = _context.sent;
-          (0, _context.t0)('[fetch]', '[response]', _context.t1);
-          _context.next = 38;
-          break;
-        case 31:
-          _context.prev = 31;
-          _context.t2 = _context["catch"](23);
-          _context.t3 = info;
-          _context.next = 36;
-          return response.clone().text();
-        case 36:
-          _context.t4 = _context.sent;
-          (0, _context.t3)('[fetch]', '[response]', _context.t4);
-        case 38:
-          return _context.abrupt("return", response);
-        case 39:
-          if (!((response == null ? void 0 : response.status) === 401)) {
-            _context.next = 41;
-            break;
+
+var _excluded$1 = ["afterCreate"];
+var NileDatabase = /*#__PURE__*/function () {
+  function NileDatabase(config, id) {
+    var _this = this;
+    this.pool = void 0;
+    this.tenantId = void 0;
+    this.userId = void 0;
+    this.id = void 0;
+    this.config = void 0;
+    this.timer = void 0;
+    var _Logger = Logger(config, '[NileInstance]'),
+      warn = _Logger.warn,
+      info = _Logger.info;
+    this.id = id;
+    var poolConfig = _extends({
+      min: 0,
+      max: 10,
+      idleTimeoutMillis: 30000
+    }, config.db);
+    var afterCreate = poolConfig.afterCreate,
+      remaining = _objectWithoutPropertiesLoose(poolConfig, _excluded$1);
+    config.db = poolConfig;
+    this.config = config;
+    info(this.config.db);
+    this.pool = createProxyForPool(new pg.Pool(remaining), this.config);
+    if (typeof afterCreate === 'function') {
+      warn('Providing an pool configuration will stop automatic tenant context setting.');
+    }
+    // start the timer for cleanup
+    this.startTimeout();
+    this.pool.on('connect', /*#__PURE__*/function () {
+      var _ref = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(client) {
+        var afterCreate;
+        return _regeneratorRuntime().wrap(function _callee$(_context) {
+          while (1) switch (_context.prev = _context.next) {
+            case 0:
+              info('pool connected');
+              afterCreate = makeAfterCreate(config);
+              afterCreate(client, function (err) {
+                var _Logger2 = Logger(config, '[after create callback]'),
+                  error = _Logger2.error;
+                if (err) {
+                  error('after create failed', err);
+                  evictPool(_this.id);
+                }
+              });
+              _this.startTimeout();
+            case 4:
+            case "end":
+              return _context.stop();
           }
-          return _context.abrupt("return", new ResponseError('Unauthorized', {
-            status: 401
-          }));
-        case 41:
-          if (!((response == null ? void 0 : response.status) === 405)) {
-            _context.next = 43;
-            break;
-          }
-          return _context.abrupt("return", new ResponseError('Method not allowed', {
-            status: 405
-          }));
-        case 43:
-          errorHandler = typeof (response == null ? void 0 : response.clone) === 'function' ? response.clone() : null;
-          msg = '';
-          _context.prev = 45;
-          _context.next = 48;
-          return response == null ? void 0 : response.json();
-        case 48:
-          res = _context.sent;
-          _context.next = 59;
-          break;
-        case 51:
-          _context.prev = 51;
-          _context.t5 = _context["catch"](45);
-          if (!errorHandler) {
-            _context.next = 58;
-            break;
-          }
-          _context.next = 56;
-          return errorHandler.text();
-        case 56:
-          msg = _context.sent;
-          if (msg) {
-            error('[fetch]', '[response]', "[status: " + errorHandler.status + "]", msg);
-          }
-        case 58:
-          if (!msg) {
-            error('[fetch]', '[response]', _context.t5);
-          }
-        case 59:
-          if (!msg) {
-            _context.next = 61;
-            break;
-          }
-          return _context.abrupt("return", new ResponseError(msg, {
-            status: errorHandler == null ? void 0 : errorHandler.status
-          }));
-        case 61:
-          if (!(res && 'message' in res)) {
-            _context.next = 65;
-            break;
-          }
-          _res = res, message = _res.message;
-          error('[fetch]', '[response]', "[status: " + (errorHandler == null ? void 0 : errorHandler.status) + "]", message);
-          return _context.abrupt("return", new ResponseError(message, {
-            status: 400
-          }));
-        case 65:
-          if (!(res && 'errors' in res)) {
-            _context.next = 69;
-            break;
-          }
-          _res2 = res, _res2$errors = _res2.errors, _message = _res2$errors[0];
-          error('[fetch]', '[response]', "[status: " + (errorHandler == null ? void 0 : errorHandler.status) + "]", _message);
-          return _context.abrupt("return", new ResponseError(_message, {
-            status: 400
-          }));
-        case 69:
-          error('[fetch]', '[response]', "[status: " + (errorHandler == null ? void 0 : errorHandler.status) + "]", 'UNHANDLED ERROR');
-          return _context.abrupt("return", new ResponseError(null, {
-            status: (_response$status = response == null ? void 0 : response.status) != null ? _response$status : 500
-          }));
-        case 71:
-        case "end":
-          return _context.stop();
-      }
-    }, _callee, null, [[23, 31], [45, 51]]);
-  }));
-  return _fetch2.apply(this, arguments);
-}
-
-var Requester = /*#__PURE__*/function (_Config) {
-  function Requester(config) {
-    var _this;
-    _this = _Config.call(this, config) || this;
-    _this.post = /*#__PURE__*/function () {
-      var _ref = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req, url, init) {
-        return _regeneratorRuntime().wrap(function _callee$(_context) {
-          while (1) switch (_context.prev = _context.next) {
-            case 0:
-              _context.next = 2;
-              return _this.request('POST', url, req, init);
-            case 2:
-              return _context.abrupt("return", _context.sent);
-            case 3:
-            case "end":
-              return _context.stop();
-          }
-        }, _callee);
-      }));
-      return function (_x, _x2, _x3) {
-        return _ref.apply(this, arguments);
-      };
-    }();
-    _this.get = /*#__PURE__*/function () {
-      var _ref2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(req, url, init) {
-        return _regeneratorRuntime().wrap(function _callee2$(_context2) {
-          while (1) switch (_context2.prev = _context2.next) {
-            case 0:
-              _context2.next = 2;
-              return _this.request('GET', url, req, init);
-            case 2:
-              return _context2.abrupt("return", _context2.sent);
-            case 3:
-            case "end":
-              return _context2.stop();
+        }, _callee);
+      }));
+      return function (_x) {
+        return _ref.apply(this, arguments);
+      };
+    }());
+    this.pool.on('error', /*#__PURE__*/function () {
+      var _ref2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(e) {
+        return _regeneratorRuntime().wrap(function _callee2$(_context2) {
+          while (1) switch (_context2.prev = _context2.next) {
+            case 0:
+              info('pool failed', e);
+              if (_this.timer) {
+                clearTimeout(_this.timer);
+              }
+              evictPool(_this.id);
+            case 3:
+            case "end":
+              return _context2.stop();
           }
         }, _callee2);
       }));
-      return function (_x4, _x5, _x6) {
+      return function (_x2) {
         return _ref2.apply(this, arguments);
       };
-    }();
-    _this.put = /*#__PURE__*/function () {
-      var _ref3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee3(req, url, init) {
-        return _regeneratorRuntime().wrap(function _callee3$(_context3) {
-          while (1) switch (_context3.prev = _context3.next) {
-            case 0:
-              _context3.next = 2;
-              return _this.request('PUT', url, req, init);
-            case 2:
-              return _context3.abrupt("return", _context3.sent);
-            case 3:
-            case "end":
-              return _context3.stop();
-          }
-        }, _callee3);
-      }));
-      return function (_x7, _x8, _x9) {
-        return _ref3.apply(this, arguments);
-      };
-    }();
-    _this["delete"] = /*#__PURE__*/function () {
-      var _ref4 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee4(req, url, init) {
-        return _regeneratorRuntime().wrap(function _callee4$(_context4) {
-          while (1) switch (_context4.prev = _context4.next) {
-            case 0:
-              _context4.next = 2;
-              return _this.request('DELETE', url, req, init);
-            case 2:
-              return _context4.abrupt("return", _context4.sent);
-            case 3:
-            case "end":
-              return _context4.stop();
-          }
-        }, _callee4);
-      }));
-      return function (_x10, _x11, _x12) {
-        return _ref4.apply(this, arguments);
-      };
-    }();
-    return _this;
+    }());
   }
-  _inheritsLoose(Requester, _Config);
-  var _proto = Requester.prototype;
-  _proto.rawRequest = /*#__PURE__*/function () {
-    var _rawRequest = /*#__PURE__*/_asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee5(method, url, init, body) {
-      var _init, res;
-      return _regeneratorRuntime().wrap(function _callee5$(_context5) {
-        while (1) switch (_context5.prev = _context5.next) {
+  var _proto = NileDatabase.prototype;
+  _proto.startTimeout = function startTimeout() {
+    var _this2 = this;
+    var _Logger3 = Logger(this.config, '[NileInstance]'),
+      info = _Logger3.info;
+    if (this.timer) {
+      clearTimeout(this.timer);
+    }
+    this.timer = setTimeout( /*#__PURE__*/_asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee3() {
+      return _regeneratorRuntime().wrap(function _callee3$(_context3) {
+        while (1) switch (_context3.prev = _context3.next) {
           case 0:
-            _init = _extends({}, init, {
-              body: body,
-              method: method
+            info('Pool reached idleTimeoutMillis.', _this2.id, 'evicted after', _this2.config.db.idleTimeoutMillis, 'ms');
+            _context3.next = 3;
+            return _this2.pool.end(function () {
+              info('Pool end called');
+              // something odd going on here. Without the callback, pool.end() is flakey
             });
-            _context5.next = 3;
-            return _fetch(this, url, _init);
           case 3:
-            res = _context5.sent;
-            if (!(res instanceof ResponseError)) {
-              _context5.next = 6;
-              break;
-            }
-            return _context5.abrupt("return", res.response);
-          case 6:
-            return _context5.abrupt("return", res);
-          case 7:
+            evictPool(_this2.id);
+          case 4:
           case "end":
-            return _context5.stop();
+            return _context3.stop();
         }
-      }, _callee5, this);
-    }));
-    function rawRequest(_x13, _x14, _x15, _x16) {
-      return _rawRequest.apply(this, arguments);
-    }
-    return rawRequest;
-  }()
-  /**
-   * three optios here
-   * 1) pass in headers for a server side request
-   * 2) pass in the payload that matches the api
-   * 3) pass in the request object sent by a browser
-   * @param method
-   * @param url
-   * @param req
-   * @param init
-   * @returns
-   */
-  ;
-  _proto.request =
-  /*#__PURE__*/
-  function () {
-    var _request = /*#__PURE__*/_asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee6(method, url, req, init) {
-      var headers, tenantId, cookie, _headers, _tenantId, _cookie, body, _init;
-      return _regeneratorRuntime().wrap(function _callee6$(_context6) {
-        while (1) switch (_context6.prev = _context6.next) {
-          case 0:
-            // set the headers
-            headers = new Headers(init ? init == null ? void 0 : init.headers : {});
-            if (req instanceof Headers) {
-              tenantId = req.get(X_NILE_TENANT);
-              cookie = req.get('cookie');
-              if (tenantId) {
-                headers.set(X_NILE_TENANT, tenantId);
-              }
-              if (cookie) {
-                headers.set('cookie', cookie);
-              }
-            } else if (req instanceof Request) {
-              // pass back the X_NILE_TENANT
-              _headers = new Headers(req == null ? void 0 : req.headers);
-              _tenantId = _headers.get(X_NILE_TENANT);
-              _cookie = _headers.get('cookie');
-              if (_tenantId) {
-                headers.set(X_NILE_TENANT, _tenantId);
-              }
-              if (_cookie) {
-                headers.set('cookie', _cookie);
-              }
-            }
-            // default the body - may be the actual payload for the API
-            body = JSON.stringify(req); // comes from next/some server
-            if (!(method === 'GET')) {
-              _context6.next = 7;
-              break;
-            }
-            body = undefined;
-            _context6.next = 14;
-            break;
-          case 7:
-            if (!(req instanceof Request)) {
-              _context6.next = 13;
-              break;
-            }
-            _context6.next = 10;
-            return new Response(req.body).text();
-          case 10:
-            body = _context6.sent;
-            _context6.next = 14;
-            break;
-          case 13:
-            if (
-            // is just headers for a GET request
-            req instanceof Headers || JSON.stringify(req) === '{}' || req && typeof req === 'object' && Object.values(req).length === 0) {
-              body = undefined;
-            }
-          case 14:
-            _init = _extends({}, init, {
-              headers: headers
-            });
-            _context6.next = 17;
-            return this.rawRequest(method, url, _init, body);
-          case 17:
-            return _context6.abrupt("return", _context6.sent);
-          case 18:
-          case "end":
-            return _context6.stop();
+      }, _callee3);
+    })), this.config.db.idleTimeoutMillis);
+  };
+  return NileDatabase;
+}();
+function makeAfterCreate(config) {
+  var _Logger4 = Logger(config, '[afterCreate]'),
+    warn = _Logger4.warn,
+    info = _Logger4.info;
+  return function (conn, done) {
+    conn.on('error', function errorHandler(error) {
+      warn('Connection was terminated by server', error);
+      done(error, conn);
+    });
+    if (isUUID(config.tenantId)) {
+      var query = ["SET nile.tenant_id = '" + config.tenantId + "'"];
+      if (isUUID(config.userId)) {
+        if (!config.tenantId) {
+          warn('A user id cannot be set in context without a tenant id');
         }
-      }, _callee6, this);
-    }));
-    function request(_x17, _x18, _x19, _x20) {
-      return _request.apply(this, arguments);
-    }
-    return request;
-  }();
-  return Requester;
-}(Config);
-
-var Users = /*#__PURE__*/function (_Config) {
-  function Users(config, headers) {
-    var _this;
-    _this = _Config.call(this, config) || this;
-    _this.headers = void 0;
-    _this.createUser = /*#__PURE__*/function () {
-      var _ref = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req, init) {
-        var _requester, _init;
-        return _regeneratorRuntime().wrap(function _callee$(_context) {
-          while (1) switch (_context.prev = _context.next) {
-            case 0:
-              _requester = new Requester(_this);
-              _init = _this.handleHeaders(init);
-              _context.next = 4;
-              return _requester.post(req, _this.usersUrl, _init);
-            case 4:
-              return _context.abrupt("return", _context.sent);
-            case 5:
-            case "end":
-              return _context.stop();
-          }
-        }, _callee);
-      }));
-      return function (_x, _x2) {
-        return _ref.apply(this, arguments);
-      };
-    }();
-    _this.updateUser = /*#__PURE__*/function () {
-      var _ref2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(userId, req, init) {
-        var _requester, _init;
-        return _regeneratorRuntime().wrap(function _callee2$(_context2) {
-          while (1) switch (_context2.prev = _context2.next) {
-            case 0:
-              _requester = new Requester(_this);
-              _init = _this.handleHeaders(init);
-              _context2.next = 4;
-              return _requester.put(req, _this.usersUrl + "/" + userId, _init);
-            case 4:
-              return _context2.abrupt("return", _context2.sent);
-            case 5:
-            case "end":
-              return _context2.stop();
-          }
-        }, _callee2);
-      }));
-      return function (_x3, _x4, _x5) {
-        return _ref2.apply(this, arguments);
-      };
-    }();
-    _this.listUsers = /*#__PURE__*/function () {
-      var _ref3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee3(req, init) {
-        var _requester, _init;
-        return _regeneratorRuntime().wrap(function _callee3$(_context3) {
-          while (1) switch (_context3.prev = _context3.next) {
-            case 0:
-              _requester = new Requester(_this);
-              _init = _this.handleHeaders(init);
-              _context3.next = 4;
-              return _requester.get(req, _this.tenantUsersUrl, _init);
-            case 4:
-              return _context3.abrupt("return", _context3.sent);
-            case 5:
-            case "end":
-              return _context3.stop();
-          }
-        }, _callee3);
-      }));
-      return function (_x6, _x7) {
-        return _ref3.apply(this, arguments);
-      };
-    }();
-    _this.linkUser = /*#__PURE__*/function () {
-      var _ref4 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee4(req, init) {
-        var _requester, _init;
-        return _regeneratorRuntime().wrap(function _callee4$(_context4) {
-          while (1) switch (_context4.prev = _context4.next) {
-            case 0:
-              _requester = new Requester(_this);
-              _init = _this.handleHeaders(init);
-              _context4.next = 4;
-              return _requester.put(req, _this.tenantUsersUrl, _init);
-            case 4:
-              return _context4.abrupt("return", _context4.sent);
-            case 5:
-            case "end":
-              return _context4.stop();
-          }
-        }, _callee4);
-      }));
-      return function (_x8, _x9) {
-        return _ref4.apply(this, arguments);
-      };
-    }();
-    _this.tenantUsersDeleteUrl = function (userId) {
-      var _this$tenantId;
-      return "/tenants/" + ((_this$tenantId = _this.tenantId) != null ? _this$tenantId : '{tenantId}') + "/users/" + (userId != null ? userId : '{userId}');
-    };
-    _this.getUserId = /*#__PURE__*/function () {
-      var _ref5 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee5(req) {
-        var body;
-        return _regeneratorRuntime().wrap(function _callee5$(_context5) {
-          while (1) switch (_context5.prev = _context5.next) {
-            case 0:
-              if (!(req instanceof Request)) {
-                _context5.next = 6;
-                break;
-              }
-              _context5.next = 3;
-              return new Response(req == null ? void 0 : req.body).json();
-            case 3:
-              body = _context5.sent;
-              if (!body) {
-                _context5.next = 6;
-                break;
-              }
-              return _context5.abrupt("return", body.id);
-            case 6:
-              if (!('id' in req)) {
-                _context5.next = 8;
-                break;
-              }
-              return _context5.abrupt("return", req.id);
-            case 8:
-              return _context5.abrupt("return", null);
-            case 9:
-            case "end":
-              return _context5.stop();
-          }
-        }, _callee5);
-      }));
-      return function (_x10) {
-        return _ref5.apply(this, arguments);
-      };
-    }();
-    _this.unlinkUser = /*#__PURE__*/function () {
-      var _ref6 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee6(req, init) {
-        var _requester, userId, _init;
-        return _regeneratorRuntime().wrap(function _callee6$(_context6) {
-          while (1) switch (_context6.prev = _context6.next) {
-            case 0:
-              _requester = new Requester(_this);
-              _context6.next = 3;
-              return _this.getUserId(req);
-            case 3:
-              userId = _context6.sent;
-              _init = _this.handleHeaders(init);
-              _context6.next = 7;
-              return _requester["delete"](req, _this.tenantUsersDeleteUrl(userId), _init);
-            case 7:
-              return _context6.abrupt("return", _context6.sent);
-            case 8:
-            case "end":
-              return _context6.stop();
-          }
-        }, _callee6);
-      }));
-      return function (_x11, _x12) {
-        return _ref6.apply(this, arguments);
-      };
-    }();
-    _this.me = /*#__PURE__*/function () {
-      var _ref7 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee7(req, init) {
-        var _requester, _init;
-        return _regeneratorRuntime().wrap(function _callee7$(_context7) {
-          while (1) switch (_context7.prev = _context7.next) {
-            case 0:
-              _requester = new Requester(_this);
-              _init = _this.handleHeaders(init);
-              _context7.next = 4;
-              return _requester.get(req, _this.meUrl, _init);
-            case 4:
-              return _context7.abrupt("return", _context7.sent);
-            case 5:
-            case "end":
-              return _context7.stop();
-          }
-        }, _callee7);
-      }));
-      return function (_x13, _x14) {
-        return _ref7.apply(this, arguments);
-      };
-    }();
-    _this.headers = headers;
-    return _this;
-  }
-  _inheritsLoose(Users, _Config);
-  var _proto = Users.prototype;
-  _proto.handleHeaders = function handleHeaders(init) {
-    if (this.headers) {
-      if (init) {
-        var _init2;
-        init.headers = new Headers(_extends({}, this.headers, (_init2 = init) == null ? void 0 : _init2.headers));
-        return init;
-      } else {
-        init = {
-          headers: this.headers
-        };
-        return init;
-      }
-    }
-    return undefined;
-  };
-  return _createClass(Users, [{
-    key: "usersUrl",
-    get: function get() {
-      return '/users';
-    }
-  }, {
-    key: "tenantUsersUrl",
-    get: function get() {
-      var _this$tenantId2;
-      return "/tenants/" + ((_this$tenantId2 = this.tenantId) != null ? _this$tenantId2 : '{tenantId}') + "/users";
-    }
-  }, {
-    key: "meUrl",
-    get: function get() {
-      return '/me';
-    }
-  }]);
-}(Config);
-
-var Tenants = /*#__PURE__*/function (_Config) {
-  function Tenants(config, headers) {
-    var _this;
-    _this = _Config.call(this, config) || this;
-    _this.headers = void 0;
-    _this.createTenant = /*#__PURE__*/function () {
-      var _ref = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req, init) {
-        var _requester, _init;
-        return _regeneratorRuntime().wrap(function _callee$(_context) {
-          while (1) switch (_context.prev = _context.next) {
-            case 0:
-              _requester = new Requester(_this);
-              _init = _this.handleHeaders(init);
-              return _context.abrupt("return", _requester.post(req, _this.tenantsUrl, _init));
-            case 3:
-            case "end":
-              return _context.stop();
-          }
-        }, _callee);
-      }));
-      return function (_x, _x2) {
-        return _ref.apply(this, arguments);
-      };
-    }();
-    _this.getTenant = /*#__PURE__*/function () {
-      var _ref2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(req, init) {
-        var _requester, _init;
-        return _regeneratorRuntime().wrap(function _callee2$(_context2) {
-          while (1) switch (_context2.prev = _context2.next) {
-            case 0:
-              _requester = new Requester(_this);
-              _init = _this.handleHeaders(init);
-              return _context2.abrupt("return", _requester.get(req, _this.tenantUrl, _init));
-            case 3:
-            case "end":
-              return _context2.stop();
-          }
-        }, _callee2);
-      }));
-      return function (_x3, _x4) {
-        return _ref2.apply(this, arguments);
-      };
-    }();
-    _this.headers = headers;
-    return _this;
-  }
-  _inheritsLoose(Tenants, _Config);
-  var _proto = Tenants.prototype;
-  _proto.handleHeaders = function handleHeaders(init) {
-    if (this.headers) {
-      if (init) {
-        var _init2;
-        init.headers = new Headers(_extends({}, this.headers, (_init2 = init) == null ? void 0 : _init2.headers));
-        return init;
-      } else {
-        init = {
-          headers: this.headers
-        };
-        return init;
-      }
-    }
-    return undefined;
-  };
-  return _createClass(Tenants, [{
-    key: "tenantsUrl",
-    get: function get() {
-      return '/tenants';
-    }
-  }, {
-    key: "tenantUrl",
-    get: function get() {
-      var _this$tenantId;
-      return "/tenants/" + ((_this$tenantId = this.tenantId) != null ? _this$tenantId : '{tenantId}');
-    }
-  }]);
-}(Config);
-
-function createProxyForPool(pool, config) {
-  var _Logger = Logger(config, '[pool]'),
-    info = _Logger.info,
-    error = _Logger.error;
-  return new Proxy(pool, {
-    get: function get(target, property) {
-      if (property === 'query') {
-        // give connection string a pass for these problems
-        if (!config.db.connectionString) {
-          if (!config.user || !config.password) {
-            error('Cannot connect to the database. User and/or password are missing. Generate them at https://console.thenile.dev');
-          } else if (!config.db.database) {
-            error('Database name is missing from the config. Call `nile.init()` or set NILEDB_ID in your .env');
-          }
-        }
-        var caller = target[property];
-        return function query() {
-          for (var _len = arguments.length, args = new Array(_len), _key = 0; _key < _len; _key++) {
-            args[_key] = arguments[_key];
-          }
-          info.apply(void 0, args);
-          // @ts-expect-error - not mine
-          var called = caller.apply(this, args);
-          return called;
-        };
-      }
-      return target[property];
-    }
-  });
-}
-
-var _excluded$1 = ["afterCreate"];
-var NileDatabase = /*#__PURE__*/function () {
-  function NileDatabase(config, id) {
-    var _this = this;
-    this.pool = void 0;
-    this.tenantId = void 0;
-    this.userId = void 0;
-    this.id = void 0;
-    this.config = void 0;
-    this.timer = void 0;
-    var _Logger = Logger(config, '[NileInstance]'),
-      warn = _Logger.warn,
-      info = _Logger.info;
-    this.id = id;
-    var poolConfig = _extends({
-      min: 0,
-      max: 10,
-      idleTimeoutMillis: 30000
-    }, config.db);
-    var afterCreate = poolConfig.afterCreate,
-      remaining = _objectWithoutPropertiesLoose(poolConfig, _excluded$1);
-    config.db = poolConfig;
-    this.config = config;
-    info(this.config.db);
-    this.pool = createProxyForPool(new pg.Pool(remaining), this.config);
-    if (typeof afterCreate === 'function') {
-      warn('Providing an pool configuration will stop automatic tenant context setting.');
-    }
-    // start the timer for cleanup
-    this.startTimeout();
-    this.pool.on('connect', /*#__PURE__*/function () {
-      var _ref = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(client) {
-        var afterCreate;
-        return _regeneratorRuntime().wrap(function _callee$(_context) {
-          while (1) switch (_context.prev = _context.next) {
-            case 0:
-              info('pool connected');
-              afterCreate = makeAfterCreate(config);
-              afterCreate(client, function (err) {
-                var _Logger2 = Logger(config, '[after create callback]'),
-                  error = _Logger2.error;
-                if (err) {
-                  error('after create failed', err);
-                  evictPool(_this.id);
-                }
-              });
-              _this.startTimeout();
-            case 4:
-            case "end":
-              return _context.stop();
-          }
-        }, _callee);
-      }));
-      return function (_x) {
-        return _ref.apply(this, arguments);
-      };
-    }());
-    this.pool.on('error', /*#__PURE__*/function () {
-      var _ref2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(e) {
-        return _regeneratorRuntime().wrap(function _callee2$(_context2) {
-          while (1) switch (_context2.prev = _context2.next) {
-            case 0:
-              info('pool failed', e);
-              if (_this.timer) {
-                clearTimeout(_this.timer);
-              }
-              evictPool(_this.id);
-            case 3:
-            case "end":
-              return _context2.stop();
-          }
-        }, _callee2);
-      }));
-      return function (_x2) {
-        return _ref2.apply(this, arguments);
-      };
-    }());
-  }
-  var _proto = NileDatabase.prototype;
-  _proto.startTimeout = function startTimeout() {
-    var _this2 = this;
-    var _Logger3 = Logger(this.config, '[NileInstance]'),
-      info = _Logger3.info;
-    if (this.timer) {
-      clearTimeout(this.timer);
-    }
-    this.timer = setTimeout( /*#__PURE__*/_asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee3() {
-      return _regeneratorRuntime().wrap(function _callee3$(_context3) {
-        while (1) switch (_context3.prev = _context3.next) {
-          case 0:
-            info('Pool reached idleTimeoutMillis.', _this2.id, 'evicted after', _this2.config.db.idleTimeoutMillis, 'ms');
-            _context3.next = 3;
-            return _this2.pool.end(function () {
-              info('Pool end called');
-              // something odd going on here. Without the callback, pool.end() is flakey
-            });
-          case 3:
-            evictPool(_this2.id);
-          case 4:
-          case "end":
-            return _context3.stop();
-        }
-      }, _callee3);
-    })), this.config.db.idleTimeoutMillis);
-  };
-  return NileDatabase;
-}();
-function makeAfterCreate(config) {
-  var _Logger4 = Logger(config, '[afterCreate]'),
-    warn = _Logger4.warn,
-    info = _Logger4.info;
-  return function (conn, done) {
-    conn.on('error', function errorHandler(error) {
-      warn('Connection was terminated by server', error);
-      done(error, conn);
-    });
-    if (config.tenantId) {
-      var query = ["SET nile.tenant_id = '" + config.tenantId + "'"];
-      if (config.userId) {
-        if (!config.tenantId) {
-          warn('A user id cannot be set in context without a tenant id');
-        }
-        query.push("SET nile.user_id = '" + config.userId + "'");
-      }
-      // in this example we use pg driver's connection API
-      conn.query(query.join(';'), function (err) {
-        if (config.tenantId) {
-          info('[tenant id]', config.tenantId);
-        }
-        if (config.userId) {
-          info('[user id]', config.userId);
-        }
-        done(err, conn);
-      });
+        query.push("SET nile.user_id = '" + config.userId + "'");
+      }
+      // in this example we use pg driver's connection API
+      conn.query(query.join(';'), function (err) {
+        if (query.length === 1) {
+          info('[tenant id]', config.tenantId);
+        }
+        if (query.length === 2) {
+          info('[user id]', config.userId);
+        }
+        done(err, conn);
+      });
     }
     done(null, conn);
   };
@@ -1895,171 +1191,44 @@ var DBManager = /*#__PURE__*/function () {
         watchEvictPool(_this.poolWatcher(config));
       }
       return newOne.pool;
-    };
-    this.clear = function (config) {
-      var _Logger3 = Logger(config, '[DBManager]'),
-        info = _Logger3.info;
-      info('Clearing all connections', _this.connections.size);
-      closeEvictPool(_this.poolWatcher(config));
-      _this.cleared = true;
-      _this.connections.clear();
-    };
-    var _Logger4 = Logger(_config, '[DBManager]'),
-      _info = _Logger4.info;
-    this.cleared = false;
-    this.connections = new Map();
-    // add the base one, so you can at least query
-    var _id = this.makeId();
-    _info('constructor', _id);
-    this.connections.set(_id, new NileDatabase(new Config(_config), _id));
-    watchEvictPool(this.poolWatcher(_config));
-  }
-  var _proto = DBManager.prototype;
-  _proto.makeId = function makeId(tenantId, userId) {
-    if (tenantId && userId) {
-      return tenantId + ":" + userId;
-    }
-    if (tenantId) {
-      return "" + tenantId;
-    }
-    return 'base';
-  };
-  return DBManager;
-}();
-
-var getServerId = function getServerId(config) {
-  var cfg = new Config(config);
-  return makeServerId(cfg);
-};
-var makeServerId = function makeServerId(config) {
-  return Buffer.from(JSON.stringify(config), 'base64').toString();
-};
-
-/**
- * a helper function to log in server side.
- */
-function serverAuth(config, handlers) {
-  return /*#__PURE__*/function () {
-    var _login = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(_ref) {
-      var _yield$csrfRes$json, _exec;
-      var email, password, sessionUrl, sessionReq, sessionRes, providers, csrf, csrfReq, csrfRes, _ref2, csrfToken, credentials, csrfCookie, signInUrl, postReq, loginRes, authCookie, _ref3, token;
-      return _regeneratorRuntime().wrap(function _callee$(_context) {
-        while (1) switch (_context.prev = _context.next) {
-          case 0:
-            email = _ref.email, password = _ref.password;
-            sessionUrl = new URL(config.api.localPath + "/api/auth/providers");
-            sessionReq = new Request(sessionUrl, {
-              method: 'GET',
-              headers: new Headers({
-                host: sessionUrl.host
-              })
-            });
-            _context.next = 5;
-            return handlers.POST(sessionReq);
-          case 5:
-            sessionRes = _context.sent;
-            _context.next = 8;
-            return sessionRes == null ? void 0 : sessionRes.json();
-          case 8:
-            providers = _context.sent;
-            csrf = new URL(config.api.localPath + "/api/auth/csrf");
-            csrfReq = new Request(csrf, {
-              method: 'GET',
-              headers: new Headers({
-                host: sessionUrl.host
-              })
-            });
-            _context.next = 13;
-            return handlers.POST(csrfReq);
-          case 13:
-            csrfRes = _context.sent;
-            _context.next = 16;
-            return csrfRes == null ? void 0 : csrfRes.json();
-          case 16:
-            _context.t0 = _yield$csrfRes$json = _context.sent;
-            if (!(_context.t0 != null)) {
-              _context.next = 21;
-              break;
-            }
-            _context.t1 = _yield$csrfRes$json;
-            _context.next = 22;
-            break;
-          case 21:
-            _context.t1 = {};
-          case 22:
-            _ref2 = _context.t1;
-            csrfToken = _ref2.csrfToken;
-            credentials = providers.credentials;
-            csrfCookie = csrfRes == null ? void 0 : csrfRes.headers.get('set-cookie');
-            expect(csrfCookie).toContain('nile.csrf-token=');
-            signInUrl = new URL(credentials.callbackUrl);
-            if (csrfCookie) {
-              _context.next = 30;
-              break;
-            }
-            throw new Error('unable to authenticate REST');
-          case 30:
-            postReq = new Request(signInUrl, {
-              method: 'POST',
-              headers: new Headers({
-                'content-type': 'application/json',
-                cookie: csrfCookie
-              }),
-              body: JSON.stringify({
-                email: email,
-                password: password,
-                csrfToken: csrfToken,
-                callbackUrl: credentials.callbackUrl
-              })
-            });
-            _context.next = 33;
-            return handlers.POST(postReq);
-          case 33:
-            loginRes = _context.sent;
-            authCookie = loginRes == null ? void 0 : loginRes.headers.get('set-cookie');
-            if (authCookie) {
-              _context.next = 37;
-              break;
-            }
-            throw new Error('authentication failed');
-          case 37:
-            expect(authCookie).toContain('nile.session-token=');
-            _ref3 = (_exec = /(nile\.session-token=.+?);/.exec(authCookie)) != null ? _exec : [], token = _ref3[1];
-            return _context.abrupt("return", new Headers({
-              cookie: [token, csrfCookie].join('; ')
-            }));
-          case 40:
-          case "end":
-            return _context.stop();
-        }
-      }, _callee);
-    }));
-    function login(_x) {
-      return _login.apply(this, arguments);
-    }
-    return login;
-  }();
-}
-
-var appRoutes = function appRoutes(prefix) {
-  if (prefix === void 0) {
-    prefix = '/api';
+    };
+    this.clear = function (config) {
+      var _Logger3 = Logger(config, '[DBManager]'),
+        info = _Logger3.info;
+      info('Clearing all connections', _this.connections.size);
+      closeEvictPool(_this.poolWatcher(config));
+      _this.cleared = true;
+      _this.connections.clear();
+    };
+    var _Logger4 = Logger(_config, '[DBManager]'),
+      _info = _Logger4.info;
+    this.cleared = false;
+    this.connections = new Map();
+    // add the base one, so you can at least query
+    var _id = this.makeId();
+    _info('constructor', _id);
+    this.connections.set(_id, new NileDatabase(new Config(_config), _id));
+    watchEvictPool(this.poolWatcher(_config));
   }
-  return {
-    SIGNIN: prefix + "/auth/signin",
-    PROVIDERS: prefix + "/auth/providers",
-    SESSION: prefix + "/auth/session",
-    CSRF: prefix + "/auth/csrf",
-    CALLBACK: prefix + "/auth/callback",
-    SIGNOUT: prefix + "/auth/signout",
-    ERROR: prefix + "/auth/error",
-    ME: prefix + "/me",
-    USERS: prefix + "/users",
-    TENANTS: prefix + "/tenants",
-    TENANT_USER: prefix + "/tenants/{tenantId}/users/{userId}",
-    TENANT_USERS: prefix + "/tenants/{tenantId}/users",
-    SIGNUP: prefix + "/signup"
+  var _proto = DBManager.prototype;
+  _proto.makeId = function makeId(tenantId, userId) {
+    if (isUUID(tenantId) && isUUID(userId)) {
+      return tenantId + ":" + userId;
+    }
+    if (isUUID(tenantId)) {
+      return "" + tenantId;
+    }
+    return 'base';
   };
+  return DBManager;
+}();
+
+var getServerId = function getServerId(config) {
+  var cfg = new Config(config);
+  return makeServerId(cfg);
+};
+var makeServerId = function makeServerId(config) {
+  return Buffer.from(JSON.stringify(config), 'utf8').toString('base64');
 };
 
 var NILEDB_API_URL = process.env.NILEDB_API_URL;
@@ -2103,40 +1272,56 @@ function urlMatches(requestUrl, route) {
 }
 
 var _excluded = ["request"];
-// const { log } = console;
-function request(_x, _x2) {
+var _console$1 = console,
+  log$1 = _console$1.log;
+function request(_x, _x2, _x3) {
   return _request.apply(this, arguments);
 }
 function _request() {
-  _request = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(url, _init) {
-    var request, init, requestUrl, updatedHeaders, params, _init$body, res;
+  _request = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(url, _init, config) {
+    var _params$method;
+    var _Logger, info, error, request, init, requestUrl, updatedHeaders, params, _init$body, res, loggingRes;
     return _regeneratorRuntime().wrap(function _callee$(_context) {
       while (1) switch (_context.prev = _context.next) {
         case 0:
+          _Logger = Logger(_extends({}, config, {
+            debug: config == null ? void 0 : config.debug
+          }), '[REQUEST]', "[" + url + "]"), info = _Logger.info, error = _Logger.error;
           request = _init.request, init = _objectWithoutPropertiesLoose(_init, _excluded);
           requestUrl = new URL(request.url);
-          updatedHeaders = new Headers(request.headers); // updatedHeaders.delete('content-length');
-          // updatedHeaders.delete('transfer-encoding');
+          updatedHeaders = new Headers(request.headers);
+          updatedHeaders.set('host', requestUrl.host);
           updatedHeaders.set('niledb-origin', requestUrl.origin);
           updatedHeaders.set('niledb-creds', Buffer.from(process.env.NILEDB_USER + ":" + process.env.NILEDB_PASSWORD).toString('base64'));
           params = _extends({}, init, {
             headers: updatedHeaders
           });
           if (params.method === 'POST' || params.method === 'PUT') {
-            updatedHeaders.set('content-type', 'text/plain;charset=UTF-8');
             params.body = (_init$body = init.body) != null ? _init$body : request.body;
             // @ts-expect-error - its there
             params.duplex = 'half';
           }
-          // log(`[${params.method ?? 'GET'}]`, url);
-          _context.next = 9;
-          return fetch(url, _extends({}, params))["catch"](function () {
-            // log('An error has occurred in the fetch', e);
+          log$1("[" + ((_params$method = params.method) != null ? _params$method : 'GET') + "]", url);
+          _context.next = 12;
+          return fetch(url, _extends({}, params))["catch"](function (e) {
+            error('An error has occurred in the fetch', e);
+            return new Response('An unexpected (most likely configuration) problem has occurred', {
+              status: 500
+            });
           });
-        case 9:
+        case 12:
           res = _context.sent;
+          loggingRes = typeof (res == null ? void 0 : res.clone) === 'function' ? res == null ? void 0 : res.clone() : null;
+          _context.t0 = info;
+          _context.t1 = res == null ? void 0 : res.status;
+          _context.t2 = res == null ? void 0 : res.statusText;
+          _context.next = 19;
+          return loggingRes == null ? void 0 : loggingRes.text();
+        case 19:
+          _context.t3 = _context.sent;
+          (0, _context.t0)('[Response]', _context.t1, _context.t2, _context.t3);
           return _context.abrupt("return", res);
-        case 11:
+        case 22:
         case "end":
           return _context.stop();
       }
@@ -2180,15 +1365,17 @@ function GET$3(_x, _x2) {
 }
 function _GET$3() {
   _GET$3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(init, log) {
+    var res;
     return _regeneratorRuntime().wrap(function _callee$(_context) {
       while (1) switch (_context.prev = _context.next) {
         case 0:
-          log('[GET]');
+          log('[GET]', url);
           _context.next = 3;
           return request(url, init);
         case 3:
-          return _context.abrupt("return", _context.sent);
-        case 4:
+          res = _context.sent;
+          return _context.abrupt("return", res);
+        case 5:
         case "end":
           return _context.stop();
       }
@@ -2244,36 +1431,253 @@ function _auth() {
       while (1) switch (_context.prev = _context.next) {
         case 0:
           _Logger = Logger(_extends({}, config, {
-            debug: true
+            debug: config.debug
           }), '[nileauth]'), info = _Logger.info;
           info('checking auth');
           sessionUrl = config.api.basePath + "/auth/session";
           info('using session', sessionUrl);
-          _context.next = 6;
+          // handle the pass through with posts
+          req.headers["delete"]('content-length');
+          _context.next = 7;
           return request(sessionUrl, {
             request: req
           });
-        case 6:
+        case 7:
           res = _context.sent;
           if (res) {
-            _context.next = 10;
+            _context.next = 11;
+            break;
+          }
+          info('no session found');
+          return _context.abrupt("return", undefined);
+        case 11:
+          info('session active');
+          _context.next = 14;
+          return new Response(res.body).json();
+        case 14:
+          return _context.abrupt("return", _context.sent);
+        case 15:
+        case "end":
+          return _context.stop();
+      }
+    }, _callee);
+  }));
+  return _auth.apply(this, arguments);
+}
+
+var ResponseError = function ResponseError(body, init) {
+  this.response = void 0;
+  this.response = new Response(body, init);
+};
+
+var X_NILE_TENANT = 'niledb-tenant-id';
+var X_NILE_USER_ID = 'niledb-user-id';
+function getTokenFromCookie(headers, cookieKey) {
+  var _headers$get;
+  var cookie = (_headers$get = headers.get('cookie')) == null ? void 0 : _headers$get.split('; ');
+  var _cookies = {};
+  if (cookie) {
+    for (var _iterator = _createForOfIteratorHelperLoose(cookie), _step; !(_step = _iterator()).done;) {
+      var parts = _step.value;
+      var cookieParts = parts.split('=');
+      var _cookie = cookieParts.slice(1).join('=');
+      var name = cookieParts[0];
+      _cookies[name] = _cookie;
+    }
+  }
+  if (cookie) {
+    for (var _iterator2 = _createForOfIteratorHelperLoose(cookie), _step2; !(_step2 = _iterator2()).done;) {
+      var _parts = _step2.value;
+      var _cookieParts = _parts.split('=');
+      var _cookie2 = _cookieParts.slice(1).join('=');
+      var _name = _cookieParts[0];
+      _cookies[_name] = _cookie2;
+    }
+  }
+  if (cookieKey) {
+    return _cookies[cookieKey];
+  }
+  return null;
+}
+function getTenantFromHttp(headers, config) {
+  var _ref;
+  var cookieTenant = getTokenFromCookie(headers, X_NILE_TENANT);
+  return (_ref = cookieTenant != null ? cookieTenant : headers == null ? void 0 : headers.get(X_NILE_TENANT)) != null ? _ref : config == null ? void 0 : config.tenantId;
+}
+function getUserFromHttp(headers, config) {
+  var _headers$get2;
+  var token = getTokenFromCookie(headers, config.api.cookieKey);
+  if (token) {
+    var jwt = jose.decodeJwt(token);
+    return jwt.sub;
+  }
+  return (_headers$get2 = headers == null ? void 0 : headers.get(X_NILE_USER_ID)) != null ? _headers$get2 : config.userId;
+}
+function _fetch(_x, _x2, _x3) {
+  return _fetch2.apply(this, arguments);
+}
+function _fetch2() {
+  _fetch2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(config, path, opts) {
+    var _config$api, _config$api2, _response$status;
+    var _Logger, info, error, url, cookieKey, headers, basicHeaders, creds, authHeader, token, tenantId, userId, useableUrl, response, res, errorHandler, msg, _res, message, _res2, _res2$errors, _message;
+    return _regeneratorRuntime().wrap(function _callee$(_context) {
+      while (1) switch (_context.prev = _context.next) {
+        case 0:
+          _Logger = Logger(config, '[server]'), info = _Logger.info, error = _Logger.error;
+          url = "" + ((_config$api = config.api) == null ? void 0 : _config$api.basePath) + path;
+          cookieKey = (_config$api2 = config.api) == null ? void 0 : _config$api2.cookieKey;
+          headers = new Headers(opts == null ? void 0 : opts.headers);
+          basicHeaders = new Headers(opts == null ? void 0 : opts.headers);
+          basicHeaders.set('content-type', 'application/json; charset=utf-8');
+          creds = Buffer.from(process.env.NILEDB_USER + ":" + process.env.NILEDB_PASSWORD, 'utf8').toString('base64');
+          basicHeaders.set('niledb-creds', creds);
+          authHeader = headers.get('Authorization');
+          if (!authHeader) {
+            token = getTokenFromCookie(headers, cookieKey);
+            if (token) {
+              basicHeaders.set('Authorization', "Bearer " + token);
+            } else if (getToken({
+              config: config
+            })) {
+              basicHeaders.set('Authorization', "Bearer " + getToken({
+                config: config
+              }));
+            }
+          }
+          tenantId = getTenantFromHttp(headers, config);
+          updateTenantId(tenantId);
+          userId = getUserFromHttp(headers, config);
+          updateUserId(userId);
+          if (!(url.includes('{tenantId}') && !tenantId)) {
+            _context.next = 16;
+            break;
+          }
+          return _context.abrupt("return", new ResponseError('tenantId is not set for request', {
+            status: 400
+          }));
+        case 16:
+          useableUrl = url.replace('{tenantId}', encodeURIComponent(String(tenantId))).replace('{userId}', encodeURIComponent(String(userId)));
+          info('[fetch]', useableUrl);
+          _context.next = 20;
+          return fetch(useableUrl, _extends({}, opts, {
+            headers: basicHeaders
+          }))["catch"](function (e) {
+            error('[fetch]', '[response]', e);
+          });
+        case 20:
+          response = _context.sent;
+          if (!(response && response.status >= 200 && response.status < 300)) {
+            _context.next = 39;
+            break;
+          }
+          if (!(typeof response.clone === 'function')) {
+            _context.next = 38;
+            break;
+          }
+          _context.prev = 23;
+          _context.t0 = info;
+          _context.next = 27;
+          return response.clone().json();
+        case 27:
+          _context.t1 = _context.sent;
+          (0, _context.t0)('[fetch]', '[response]', _context.t1);
+          _context.next = 38;
+          break;
+        case 31:
+          _context.prev = 31;
+          _context.t2 = _context["catch"](23);
+          _context.t3 = info;
+          _context.next = 36;
+          return response.clone().text();
+        case 36:
+          _context.t4 = _context.sent;
+          (0, _context.t3)('[fetch]', '[response]', _context.t4);
+        case 38:
+          return _context.abrupt("return", response);
+        case 39:
+          if (!((response == null ? void 0 : response.status) === 401)) {
+            _context.next = 41;
+            break;
+          }
+          return _context.abrupt("return", new ResponseError('Unauthorized', {
+            status: 401
+          }));
+        case 41:
+          if (!((response == null ? void 0 : response.status) === 405)) {
+            _context.next = 43;
+            break;
+          }
+          return _context.abrupt("return", new ResponseError('Method not allowed', {
+            status: 405
+          }));
+        case 43:
+          errorHandler = typeof (response == null ? void 0 : response.clone) === 'function' ? response.clone() : null;
+          msg = '';
+          _context.prev = 45;
+          _context.next = 48;
+          return response == null ? void 0 : response.json();
+        case 48:
+          res = _context.sent;
+          _context.next = 59;
+          break;
+        case 51:
+          _context.prev = 51;
+          _context.t5 = _context["catch"](45);
+          if (!errorHandler) {
+            _context.next = 58;
+            break;
+          }
+          _context.next = 56;
+          return errorHandler.text();
+        case 56:
+          msg = _context.sent;
+          if (msg) {
+            error('[fetch]', '[response]', "[status: " + errorHandler.status + "]", msg);
+          }
+        case 58:
+          if (!msg) {
+            error('[fetch]', '[response]', _context.t5);
+          }
+        case 59:
+          if (!msg) {
+            _context.next = 61;
             break;
           }
-          info('no session found');
-          return _context.abrupt("return", undefined);
-        case 10:
-          info('session active');
-          _context.next = 13;
-          return new Response(res.body).json();
-        case 13:
-          return _context.abrupt("return", _context.sent);
-        case 14:
+          return _context.abrupt("return", new ResponseError(msg, {
+            status: errorHandler == null ? void 0 : errorHandler.status
+          }));
+        case 61:
+          if (!(res && 'message' in res)) {
+            _context.next = 65;
+            break;
+          }
+          _res = res, message = _res.message;
+          error('[fetch]', '[response]', "[status: " + (errorHandler == null ? void 0 : errorHandler.status) + "]", message);
+          return _context.abrupt("return", new ResponseError(message, {
+            status: 400
+          }));
+        case 65:
+          if (!(res && 'errors' in res)) {
+            _context.next = 69;
+            break;
+          }
+          _res2 = res, _res2$errors = _res2.errors, _message = _res2$errors[0];
+          error('[fetch]', '[response]', "[status: " + (errorHandler == null ? void 0 : errorHandler.status) + "]", _message);
+          return _context.abrupt("return", new ResponseError(_message, {
+            status: 400
+          }));
+        case 69:
+          error('[fetch]', '[response]', "[status: " + (errorHandler == null ? void 0 : errorHandler.status) + "]", 'UNHANDLED ERROR');
+          return _context.abrupt("return", new ResponseError(null, {
+            status: (_response$status = response == null ? void 0 : response.status) != null ? _response$status : 500
+          }));
+        case 71:
         case "end":
           return _context.stop();
       }
-    }, _callee);
+    }, _callee, null, [[23, 31], [45, 51]]);
   }));
-  return _auth.apply(this, arguments);
+  return _fetch2.apply(this, arguments);
 }
 
 /**
@@ -2383,7 +1787,7 @@ function _POST$2() {
  *     - users
  *     summary: lists users in the tenant
  *     description: Returns information about the users within the tenant
- *       provided. You can also pass the a `niledb-tenantId` in the header or in a cookie.
+ *       provided. You can also pass the a `niledb-tenant-id` in the header or in a cookie.
  *     operationId: listUsers
  *     parameters:
  *       - name: tenantId
@@ -2710,7 +2114,7 @@ function _POST$1() {
 
 /**
  * @swagger
- * /api/tenants/{tenantId}/users/{userId}:
+ * /api/tenants/{tenantId}/users/{email}:
  *   delete:
  *    tags:
  *    - tenants
@@ -2724,7 +2128,7 @@ function _POST$1() {
  *      required: true
  *      schema:
  *        type: string
- *    - name: userId
+ *    - name: email
  *      in: path
  *      required: true
  *      schema:
@@ -2754,13 +2158,16 @@ function _DELETE$1() {
           }));
         case 4:
           init.method = 'DELETE';
+          init.body = JSON.stringify({
+            email: userId
+          });
           url = "" + apiRoutes.TENANT_USER(tenantId, userId);
           log('[DELETE]', url);
-          _context.next = 9;
+          _context.next = 10;
           return request(url, init);
-        case 9:
-          return _context.abrupt("return", _context.sent);
         case 10:
+          return _context.abrupt("return", _context.sent);
+        case 11:
         case "end":
           return _context.stop();
       }
@@ -2785,8 +2192,7 @@ function _DELETE$1() {
  *        type: string
  *    requestBody:
  *      description: |
- *        The email and password combination the user will use to authenticate.
- *        The `name` is optional; if provided it will be recorded in the `users` table.
+ *        The email of the user you want to add to a tenant.
  *      content:
  *        application/json:
  *          schema:
@@ -2945,17 +2351,21 @@ function GET(_x, _x2, _x3) {
 }
 function _GET() {
   _GET = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(session, init, log) {
-    var url;
+    var url, res;
     return _regeneratorRuntime().wrap(function _callee$(_context) {
       while (1) switch (_context.prev = _context.next) {
         case 0:
           url = "" + apiRoutes.USER_TENANTS(session.id);
+          if (typeof session === 'object' && 'user' in session && session.user) {
+            url = "" + apiRoutes.USER_TENANTS(session.user.id);
+          }
           log('[GET]', url);
-          _context.next = 4;
+          _context.next = 5;
           return request(url, init);
-        case 4:
-          return _context.abrupt("return", _context.sent);
         case 5:
+          res = _context.sent;
+          return _context.abrupt("return", res);
+        case 7:
         case "end":
           return _context.stop();
       }
@@ -3121,107 +2531,273 @@ function _route$7() {
           return _context.abrupt("return", new Response(null, {
             status: 401
           }));
-        case 7:
-          _context.t0 = request.method;
-          _context.next = _context.t0 === 'GET' ? 10 : _context.t0 === 'POST' ? 13 : _context.t0 === 'DELETE' ? 16 : 19;
-          break;
+        case 7:
+          _context.t0 = request.method;
+          _context.next = _context.t0 === 'GET' ? 10 : _context.t0 === 'POST' ? 13 : _context.t0 === 'DELETE' ? 16 : 19;
+          break;
+        case 10:
+          _context.next = 12;
+          return GET(session, {
+            request: request
+          }, info);
+        case 12:
+          return _context.abrupt("return", _context.sent);
+        case 13:
+          _context.next = 15;
+          return POST(session, {
+            request: request
+          }, info);
+        case 15:
+          return _context.abrupt("return", _context.sent);
+        case 16:
+          _context.next = 18;
+          return DELETE(session, {
+            request: request
+          }, info);
+        case 18:
+          return _context.abrupt("return", _context.sent);
+        case 19:
+          return _context.abrupt("return", new Response('method not allowed', {
+            status: 405
+          }));
+        case 20:
+        case "end":
+          return _context.stop();
+      }
+    }, _callee);
+  }));
+  return _route$7.apply(this, arguments);
+}
+function matches$7(configRoutes, request) {
+  return urlMatches(request.url, configRoutes[key$3]);
+}
+
+var proxyRoutes = {
+  SIGNIN: /*#__PURE__*/makeRestUrl('/auth/signin'),
+  PROVIDERS: /*#__PURE__*/makeRestUrl('/auth/providers'),
+  SESSION: /*#__PURE__*/makeRestUrl('/auth/session'),
+  CSRF: /*#__PURE__*/makeRestUrl('/auth/csrf'),
+  CALLBACK: /*#__PURE__*/makeRestUrl('/auth/callback'),
+  SIGNOUT: /*#__PURE__*/makeRestUrl('/auth/signout'),
+  ERROR: /*#__PURE__*/makeRestUrl('/auth/error')
+};
+
+var key$2 = 'SIGNIN';
+function route$6(_x) {
+  return _route$6.apply(this, arguments);
+}
+function _route$6() {
+  _route$6 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
+    var url, init, _URL$pathname$split$r, provider, passThroughUrl, params, res;
+    return _regeneratorRuntime().wrap(function _callee$(_context) {
+      while (1) switch (_context.prev = _context.next) {
+        case 0:
+          url = proxyRoutes[key$2];
+          init = {
+            method: req.method,
+            headers: req.headers
+          };
+          if (req.method === 'POST') {
+            if (typeof req.clone === 'function') {
+              init.body = req.clone().body;
+            }
+            _URL$pathname$split$r = new URL(req.url).pathname.split('/').reverse(), provider = _URL$pathname$split$r[0];
+            url = proxyRoutes[key$2] + "/" + provider;
+          }
+          passThroughUrl = new URL(req.url);
+          params = new URLSearchParams(passThroughUrl.search);
+          url = "" + url + (params.toString() !== '' ? "?" + params.toString() : '');
+          _context.next = 8;
+          return request(url, _extends({}, init, {
+            request: req
+          }));
+        case 8:
+          res = _context.sent;
+          return _context.abrupt("return", res);
+        case 10:
+        case "end":
+          return _context.stop();
+      }
+    }, _callee);
+  }));
+  return _route$6.apply(this, arguments);
+}
+function matches$6(configRoutes, request) {
+  return urlMatches(request.url, configRoutes[key$2]);
+}
+
+function route$5(_x, _x2) {
+  return _route$5.apply(this, arguments);
+}
+function _route$5() {
+  _route$5 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req, config) {
+    return _regeneratorRuntime().wrap(function _callee$(_context) {
+      while (1) switch (_context.prev = _context.next) {
+        case 0:
+          return _context.abrupt("return", request(proxyRoutes.SESSION, {
+            method: req.method,
+            request: req
+          }, config));
+        case 1:
+        case "end":
+          return _context.stop();
+      }
+    }, _callee);
+  }));
+  return _route$5.apply(this, arguments);
+}
+function matches$5(configRoutes, request) {
+  return urlMatches(request.url, configRoutes.SESSION);
+}
+
+function route$4(_x) {
+  return _route$4.apply(this, arguments);
+}
+function _route$4() {
+  _route$4 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
+    return _regeneratorRuntime().wrap(function _callee$(_context) {
+      while (1) switch (_context.prev = _context.next) {
+        case 0:
+          return _context.abrupt("return", request(proxyRoutes.PROVIDERS, {
+            method: req.method,
+            request: req
+          }));
+        case 1:
+        case "end":
+          return _context.stop();
+      }
+    }, _callee);
+  }));
+  return _route$4.apply(this, arguments);
+}
+function matches$4(configRoutes, request) {
+  return urlMatches(request.url, configRoutes.PROVIDERS);
+}
+
+function route$3(_x) {
+  return _route$3.apply(this, arguments);
+}
+function _route$3() {
+  _route$3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
+    return _regeneratorRuntime().wrap(function _callee$(_context) {
+      while (1) switch (_context.prev = _context.next) {
+        case 0:
+          return _context.abrupt("return", request(proxyRoutes.CSRF, {
+            method: req.method,
+            request: req
+          }));
+        case 1:
+        case "end":
+          return _context.stop();
+      }
+    }, _callee);
+  }));
+  return _route$3.apply(this, arguments);
+}
+function matches$3(configRoutes, request) {
+  return urlMatches(request.url, configRoutes.CSRF);
+}
+
+var _console = console,
+  log = _console.log,
+  error = _console.error;
+function route$2(_x) {
+  return _route$2.apply(this, arguments);
+}
+function _route$2() {
+  _route$2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(request$1) {
+    var _URL$pathname$split$r, provider, passThroughUrl, params, url, res, location;
+    return _regeneratorRuntime().wrap(function _callee$(_context) {
+      while (1) switch (_context.prev = _context.next) {
+        case 0:
+          _URL$pathname$split$r = new URL(request$1.url).pathname.split('/').reverse(), provider = _URL$pathname$split$r[0];
+          passThroughUrl = new URL(request$1.url);
+          params = new URLSearchParams(passThroughUrl.search);
+          url = proxyRoutes.CALLBACK + "/" + provider + (params.toString() !== '' ? "?" + params.toString() : '');
+          _context.next = 6;
+          return request(url, {
+            request: request$1,
+            method: request$1.method
+          })["catch"](function (e) {
+            error('an error has occurred in callback');
+            log(e);
+          });
+        case 6:
+          res = _context.sent;
+          location = res == null ? void 0 : res.headers.get('location');
+          if (!location) {
+            _context.next = 10;
+            break;
+          }
+          return _context.abrupt("return", new Response(res == null ? void 0 : res.body, {
+            status: 302,
+            headers: res == null ? void 0 : res.headers
+          }));
         case 10:
-          _context.next = 12;
-          return GET(session, {
-            request: request
-          }, info);
-        case 12:
-          return _context.abrupt("return", _context.sent);
-        case 13:
-          _context.next = 15;
-          return POST(session, {
-            request: request
-          }, info);
-        case 15:
-          return _context.abrupt("return", _context.sent);
-        case 16:
-          _context.next = 18;
-          return DELETE(session, {
-            request: request
-          }, info);
-        case 18:
-          return _context.abrupt("return", _context.sent);
-        case 19:
-          return _context.abrupt("return", new Response('method not allowed', {
-            status: 405
+          return _context.abrupt("return", new Response(res == null ? void 0 : res.body, {
+            status: res == null ? void 0 : res.status,
+            headers: res == null ? void 0 : res.headers
           }));
-        case 20:
+        case 11:
         case "end":
           return _context.stop();
       }
     }, _callee);
   }));
-  return _route$7.apply(this, arguments);
+  return _route$2.apply(this, arguments);
 }
-function matches$7(configRoutes, request) {
-  return urlMatches(request.url, configRoutes[key$3]);
+function matches$2(configRoutes, request) {
+  return urlMatches(request.url, configRoutes.CALLBACK);
 }
 
-var proxyRoutes = {
-  SIGNIN: /*#__PURE__*/makeRestUrl('/auth/signin'),
-  PROVIDERS: /*#__PURE__*/makeRestUrl('/auth/providers'),
-  SESSION: /*#__PURE__*/makeRestUrl('/auth/session'),
-  CSRF: /*#__PURE__*/makeRestUrl('/auth/csrf'),
-  CALLBACK: /*#__PURE__*/makeRestUrl('/auth/callback'),
-  SIGNOUT: /*#__PURE__*/makeRestUrl('/auth/signout'),
-  ERROR: /*#__PURE__*/makeRestUrl('/auth/error')
-};
-
-var key$2 = 'SIGNIN';
-function route$6(_x) {
-  return _route$6.apply(this, arguments);
+var key$1 = 'SIGNOUT';
+function route$1(_x) {
+  return _route$1.apply(this, arguments);
 }
-function _route$6() {
-  _route$6 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(request$1) {
-    var url, init, _URL$pathname$split$r, provider, passThroughUrl, params, res;
+function _route$1() {
+  _route$1 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(request$1) {
+    var url, init, _URL$pathname$split$r, provider, res;
     return _regeneratorRuntime().wrap(function _callee$(_context) {
       while (1) switch (_context.prev = _context.next) {
         case 0:
-          url = proxyRoutes[key$2];
+          url = proxyRoutes[key$1];
           init = {
             method: request$1.method
           };
           if (request$1.method === 'POST') {
             init.body = request$1.body;
             _URL$pathname$split$r = new URL(request$1.url).pathname.split('/').reverse(), provider = _URL$pathname$split$r[0];
-            url = proxyRoutes[key$2] + "/" + provider;
+            url = proxyRoutes[key$1] + "/" + provider;
           }
-          passThroughUrl = new URL(request$1.url);
-          params = new URLSearchParams(passThroughUrl.search);
-          url = "" + url + (params.toString() !== '' ? "?" + params.toString() : '');
-          _context.next = 8;
+          _context.next = 5;
           return request(url, _extends({}, init, {
             request: request$1
           }));
-        case 8:
+        case 5:
           res = _context.sent;
           return _context.abrupt("return", res);
-        case 10:
+        case 7:
         case "end":
           return _context.stop();
       }
     }, _callee);
   }));
-  return _route$6.apply(this, arguments);
+  return _route$1.apply(this, arguments);
 }
-function matches$6(configRoutes, request) {
-  return urlMatches(request.url, configRoutes[key$2]);
+function matches$1(configRoutes, request) {
+  return urlMatches(request.url, configRoutes[key$1]);
 }
 
-function route$5(_x) {
-  return _route$5.apply(this, arguments);
+var key = 'ERROR';
+function route(_x) {
+  return _route.apply(this, arguments);
 }
-function _route$5() {
-  _route$5 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
+function _route() {
+  _route = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
     return _regeneratorRuntime().wrap(function _callee$(_context) {
       while (1) switch (_context.prev = _context.next) {
         case 0:
-          return _context.abrupt("return", request(proxyRoutes.SESSION, {
+          return _context.abrupt("return", request(proxyRoutes[key], {
             method: req.method,
             request: req
           }));
@@ -3231,425 +2807,976 @@ function _route$5() {
       }
     }, _callee);
   }));
-  return _route$5.apply(this, arguments);
+  return _route.apply(this, arguments);
 }
-function matches$5(configRoutes, request) {
-  return urlMatches(request.url, configRoutes.SESSION);
+function matches(configRoutes, request) {
+  return urlMatches(request.url, configRoutes[key]);
 }
 
-function route$4(_x) {
-  return _route$4.apply(this, arguments);
-}
-function _route$4() {
-  _route$4 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
-    return _regeneratorRuntime().wrap(function _callee$(_context) {
-      while (1) switch (_context.prev = _context.next) {
-        case 0:
-          return _context.abrupt("return", request(proxyRoutes.PROVIDERS, {
-            method: req.method,
-            request: req
-          }));
-        case 1:
-        case "end":
-          return _context.stop();
-      }
-    }, _callee);
-  }));
-  return _route$4.apply(this, arguments);
+function GETTER(configRoutes, config) {
+  return /*#__PURE__*/function () {
+    var _GET = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
+      return _regeneratorRuntime().wrap(function _callee$(_context) {
+        while (1) switch (_context.prev = _context.next) {
+          case 0:
+            if (!matches$a(configRoutes, req)) {
+              _context.next = 2;
+              break;
+            }
+            return _context.abrupt("return", route$a(req, config));
+          case 2:
+            if (!matches$9(configRoutes, req)) {
+              _context.next = 4;
+              break;
+            }
+            return _context.abrupt("return", route$9(req, config));
+          case 4:
+            if (!matches$8(configRoutes, req)) {
+              _context.next = 6;
+              break;
+            }
+            return _context.abrupt("return", route$8(req, config));
+          case 6:
+            if (!matches$7(configRoutes, req)) {
+              _context.next = 8;
+              break;
+            }
+            return _context.abrupt("return", route$7(req, config));
+          case 8:
+            if (!matches$5(configRoutes, req)) {
+              _context.next = 10;
+              break;
+            }
+            return _context.abrupt("return", route$5(req, config));
+          case 10:
+            if (!matches$6(configRoutes, req)) {
+              _context.next = 12;
+              break;
+            }
+            return _context.abrupt("return", route$6(req));
+          case 12:
+            if (!matches$4(configRoutes, req)) {
+              _context.next = 14;
+              break;
+            }
+            return _context.abrupt("return", route$4(req));
+          case 14:
+            if (!matches$3(configRoutes, req)) {
+              _context.next = 16;
+              break;
+            }
+            return _context.abrupt("return", route$3(req));
+          case 16:
+            if (!matches$2(configRoutes, req)) {
+              _context.next = 18;
+              break;
+            }
+            return _context.abrupt("return", route$2(req));
+          case 18:
+            if (!matches$1(configRoutes, req)) {
+              _context.next = 20;
+              break;
+            }
+            return _context.abrupt("return", route$1(req));
+          case 20:
+            if (!matches(configRoutes, req)) {
+              _context.next = 22;
+              break;
+            }
+            return _context.abrupt("return", route(req));
+          case 22:
+            return _context.abrupt("return", new Response(null, {
+              status: 404
+            }));
+          case 23:
+          case "end":
+            return _context.stop();
+        }
+      }, _callee);
+    }));
+    function GET(_x) {
+      return _GET.apply(this, arguments);
+    }
+    return GET;
+  }();
 }
-function matches$4(configRoutes, request) {
-  return urlMatches(request.url, configRoutes.PROVIDERS);
+
+function POSTER(configRoutes, config) {
+  return /*#__PURE__*/function () {
+    var _POST = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
+      return _regeneratorRuntime().wrap(function _callee$(_context) {
+        while (1) switch (_context.prev = _context.next) {
+          case 0:
+            if (!matches$8(configRoutes, req)) {
+              _context.next = 2;
+              break;
+            }
+            return _context.abrupt("return", route$8(req, config));
+          case 2:
+            if (!matches$9(configRoutes, req)) {
+              _context.next = 4;
+              break;
+            }
+            return _context.abrupt("return", route$9(req, config));
+          case 4:
+            if (!matches$7(configRoutes, req)) {
+              _context.next = 6;
+              break;
+            }
+            return _context.abrupt("return", route$7(req, config));
+          case 6:
+            if (!matches$5(configRoutes, req)) {
+              _context.next = 8;
+              break;
+            }
+            return _context.abrupt("return", route$5(req, config));
+          case 8:
+            if (!matches$6(configRoutes, req)) {
+              _context.next = 10;
+              break;
+            }
+            return _context.abrupt("return", route$6(req));
+          case 10:
+            if (!matches$4(configRoutes, req)) {
+              _context.next = 12;
+              break;
+            }
+            return _context.abrupt("return", route$4(req));
+          case 12:
+            if (!matches$3(configRoutes, req)) {
+              _context.next = 14;
+              break;
+            }
+            return _context.abrupt("return", route$3(req));
+          case 14:
+            if (!matches$2(configRoutes, req)) {
+              _context.next = 16;
+              break;
+            }
+            return _context.abrupt("return", route$2(req));
+          case 16:
+            if (!matches$1(configRoutes, req)) {
+              _context.next = 18;
+              break;
+            }
+            return _context.abrupt("return", route$1(req));
+          case 18:
+            return _context.abrupt("return", new Response(null, {
+              status: 404
+            }));
+          case 19:
+          case "end":
+            return _context.stop();
+        }
+      }, _callee);
+    }));
+    function POST(_x) {
+      return _POST.apply(this, arguments);
+    }
+    return POST;
+  }();
 }
 
-function route$3(_x) {
-  return _route$3.apply(this, arguments);
-}
-function _route$3() {
-  _route$3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
-    return _regeneratorRuntime().wrap(function _callee$(_context) {
-      while (1) switch (_context.prev = _context.next) {
-        case 0:
-          return _context.abrupt("return", request(proxyRoutes.CSRF, {
-            method: req.method,
-            request: req
-          }));
-        case 1:
-        case "end":
-          return _context.stop();
-      }
-    }, _callee);
-  }));
-  return _route$3.apply(this, arguments);
-}
-function matches$3(configRoutes, request) {
-  return urlMatches(request.url, configRoutes.CSRF);
+function DELETER(configRoutes, config) {
+  return /*#__PURE__*/function () {
+    var _DELETE = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
+      return _regeneratorRuntime().wrap(function _callee$(_context) {
+        while (1) switch (_context.prev = _context.next) {
+          case 0:
+            if (!matches$8(configRoutes, req)) {
+              _context.next = 2;
+              break;
+            }
+            return _context.abrupt("return", route$8(req, config));
+          case 2:
+            if (!matches$7(configRoutes, req)) {
+              _context.next = 4;
+              break;
+            }
+            return _context.abrupt("return", route$7(req, config));
+          case 4:
+            return _context.abrupt("return", new Response(null, {
+              status: 404
+            }));
+          case 5:
+          case "end":
+            return _context.stop();
+        }
+      }, _callee);
+    }));
+    function DELETE(_x) {
+      return _DELETE.apply(this, arguments);
+    }
+    return DELETE;
+  }();
 }
 
-var _console = console,
-  log = _console.log,
-  error = _console.error;
-function route$2(_x) {
-  return _route$2.apply(this, arguments);
-}
-function _route$2() {
-  _route$2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(request$1) {
-    var _URL$pathname$split$r, provider, passThroughUrl, params, url, res, location;
-    return _regeneratorRuntime().wrap(function _callee$(_context) {
-      while (1) switch (_context.prev = _context.next) {
-        case 0:
-          _URL$pathname$split$r = new URL(request$1.url).pathname.split('/').reverse(), provider = _URL$pathname$split$r[0];
-          passThroughUrl = new URL(request$1.url);
-          params = new URLSearchParams(passThroughUrl.search);
-          url = proxyRoutes.CALLBACK + "/" + provider + (params.toString() !== '' ? "?" + params.toString() : '');
-          _context.next = 6;
-          return request(url, {
-            request: request$1,
-            method: request$1.method
-          })["catch"](function (e) {
-            error('an error has occurred in callback');
-            log(e);
-          });
-        case 6:
-          res = _context.sent;
-          location = res == null ? void 0 : res.headers.get('location');
-          if (!location) {
-            _context.next = 10;
-            break;
-          }
-          return _context.abrupt("return", new Response(res == null ? void 0 : res.body, {
-            status: 302,
-            headers: res == null ? void 0 : res.headers
-          }));
-        case 10:
-          return _context.abrupt("return", new Response(res == null ? void 0 : res.body, {
-            status: res == null ? void 0 : res.status,
-            headers: res == null ? void 0 : res.headers
-          }));
-        case 11:
-        case "end":
-          return _context.stop();
-      }
-    }, _callee);
-  }));
-  return _route$2.apply(this, arguments);
-}
-function matches$2(configRoutes, request) {
-  return urlMatches(request.url, configRoutes.CALLBACK);
+function PUTER(configRoutes, config) {
+  return /*#__PURE__*/function () {
+    var _PUT = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
+      return _regeneratorRuntime().wrap(function _callee$(_context) {
+        while (1) switch (_context.prev = _context.next) {
+          case 0:
+            if (!matches$8(configRoutes, req)) {
+              _context.next = 2;
+              break;
+            }
+            return _context.abrupt("return", route$8(req, config));
+          case 2:
+            if (!matches$9(configRoutes, req)) {
+              _context.next = 4;
+              break;
+            }
+            return _context.abrupt("return", route$9(req, config));
+          case 4:
+            if (!matches$7(configRoutes, req)) {
+              _context.next = 6;
+              break;
+            }
+            return _context.abrupt("return", route$7(req, config));
+          case 6:
+            return _context.abrupt("return", new Response(null, {
+              status: 404
+            }));
+          case 7:
+          case "end":
+            return _context.stop();
+        }
+      }, _callee);
+    }));
+    function PUT(_x) {
+      return _PUT.apply(this, arguments);
+    }
+    return PUT;
+  }();
 }
 
-var key$1 = 'SIGNOUT';
-function route$1(_x) {
-  return _route$1.apply(this, arguments);
-}
-function _route$1() {
-  _route$1 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(request$1) {
-    var url, init, _URL$pathname$split$r, provider, res;
-    return _regeneratorRuntime().wrap(function _callee$(_context) {
-      while (1) switch (_context.prev = _context.next) {
-        case 0:
-          url = proxyRoutes[key$1];
-          init = {
-            method: request$1.method
-          };
-          if (request$1.method === 'POST') {
-            init.body = request$1.body;
-            _URL$pathname$split$r = new URL(request$1.url).pathname.split('/').reverse(), provider = _URL$pathname$split$r[0];
-            url = proxyRoutes[key$1] + "/" + provider;
-          }
-          _context.next = 5;
-          return request(url, _extends({}, init, {
-            request: request$1
-          }));
-        case 5:
-          res = _context.sent;
-          return _context.abrupt("return", res);
-        case 7:
-        case "end":
-          return _context.stop();
-      }
-    }, _callee);
-  }));
-  return _route$1.apply(this, arguments);
-}
-function matches$1(configRoutes, request) {
-  return urlMatches(request.url, configRoutes[key$1]);
+function Handlers(configRoutes, config) {
+  var GET = GETTER(configRoutes, config);
+  var POST = POSTER(configRoutes, config);
+  var DELETE = DELETER(configRoutes, config);
+  var PUT = PUTER(configRoutes, config);
+  return {
+    GET: GET,
+    POST: POST,
+    DELETE: DELETE,
+    PUT: PUT
+  };
 }
 
-var key = 'ERROR';
-function route(_x) {
-  return _route.apply(this, arguments);
-}
-function _route() {
-  _route = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
-    return _regeneratorRuntime().wrap(function _callee$(_context) {
-      while (1) switch (_context.prev = _context.next) {
-        case 0:
-          return _context.abrupt("return", request(proxyRoutes[key], {
-            method: req.method,
-            request: req
-          }));
-        case 1:
-        case "end":
-          return _context.stop();
-      }
-    }, _callee);
-  }));
-  return _route.apply(this, arguments);
-}
-function matches(configRoutes, request) {
-  return urlMatches(request.url, configRoutes[key]);
-}
+var appRoutes = function appRoutes(prefix) {
+  if (prefix === void 0) {
+    prefix = '/api';
+  }
+  return {
+    SIGNIN: prefix + "/auth/signin",
+    PROVIDERS: prefix + "/auth/providers",
+    SESSION: prefix + "/auth/session",
+    CSRF: prefix + "/auth/csrf",
+    CALLBACK: prefix + "/auth/callback",
+    SIGNOUT: prefix + "/auth/signout",
+    ERROR: prefix + "/auth/error",
+    ME: prefix + "/me",
+    USERS: prefix + "/users",
+    TENANTS: prefix + "/tenants",
+    TENANT_USER: prefix + "/tenants/{tenantId}/users/{userId}",
+    TENANT_USERS: prefix + "/tenants/{tenantId}/users",
+    SIGNUP: prefix + "/signup"
+  };
+};
 
-function GETTER(configRoutes, config) {
+/**
+ * a helper function to log in server side.
+ */
+function serverAuth(config, handlers) {
+  var _Logger = Logger(config, '[serverAuth]'),
+    info = _Logger.info;
   return /*#__PURE__*/function () {
-    var _GET = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
+    var _login = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(_ref) {
+      var _yield$csrfRes$json, _exec;
+      var email, password, sessionUrl, sessionReq, sessionRes, providers, csrf, csrfReq, csrfRes, _ref2, csrfToken, credentials, csrfCookie, signInUrl, postReq, loginRes, authCookie, _ref3, token;
       return _regeneratorRuntime().wrap(function _callee$(_context) {
         while (1) switch (_context.prev = _context.next) {
           case 0:
-            if (!matches$a(configRoutes, req)) {
-              _context.next = 2;
+            email = _ref.email, password = _ref.password;
+            info('Obtaining session');
+            sessionUrl = new URL(config.api.localPath + "/api/auth/providers");
+            sessionReq = new Request(sessionUrl, {
+              method: 'GET',
+              headers: new Headers({
+                host: sessionUrl.host
+              })
+            });
+            _context.next = 6;
+            return handlers.POST(sessionReq);
+          case 6:
+            sessionRes = _context.sent;
+            _context.next = 9;
+            return sessionRes == null ? void 0 : sessionRes.json();
+          case 9:
+            providers = _context.sent;
+            info('Obtaining csrf');
+            csrf = new URL(config.api.localPath + "/api/auth/csrf");
+            csrfReq = new Request(csrf, {
+              method: 'GET',
+              headers: new Headers({
+                host: sessionUrl.host
+              })
+            });
+            _context.next = 15;
+            return handlers.POST(csrfReq);
+          case 15:
+            csrfRes = _context.sent;
+            _context.next = 18;
+            return csrfRes == null ? void 0 : csrfRes.json();
+          case 18:
+            _context.t0 = _yield$csrfRes$json = _context.sent;
+            if (!(_context.t0 != null)) {
+              _context.next = 23;
               break;
             }
-            return _context.abrupt("return", route$a(req, config));
-          case 2:
-            if (!matches$9(configRoutes, req)) {
-              _context.next = 4;
+            _context.t1 = _yield$csrfRes$json;
+            _context.next = 24;
+            break;
+          case 23:
+            _context.t1 = {};
+          case 24:
+            _ref2 = _context.t1;
+            csrfToken = _ref2.csrfToken;
+            credentials = providers.credentials;
+            csrfCookie = csrfRes == null ? void 0 : csrfRes.headers.get('set-cookie');
+            if (credentials) {
+              _context.next = 30;
               break;
             }
-            return _context.abrupt("return", route$9(req, config));
-          case 4:
-            if (!matches$8(configRoutes, req)) {
-              _context.next = 6;
+            throw new Error('Unable to obtain credential provider. Aborting server side login.');
+          case 30:
+            signInUrl = new URL(credentials.callbackUrl);
+            if (csrfCookie) {
+              _context.next = 33;
               break;
             }
-            return _context.abrupt("return", route$8(req, config));
-          case 6:
-            if (!matches$7(configRoutes, req)) {
-              _context.next = 8;
+            throw new Error('Unable to authenticate REST');
+          case 33:
+            info('Attempting sign in to', signInUrl.href);
+            postReq = new Request(signInUrl, {
+              method: 'POST',
+              headers: new Headers({
+                'content-type': 'application/json',
+                cookie: csrfCookie
+              }),
+              body: JSON.stringify({
+                email: email,
+                password: password,
+                csrfToken: csrfToken,
+                callbackUrl: credentials.callbackUrl
+              })
+            });
+            _context.next = 37;
+            return handlers.POST(postReq);
+          case 37:
+            loginRes = _context.sent;
+            authCookie = loginRes == null ? void 0 : loginRes.headers.get('set-cookie');
+            if (authCookie) {
+              _context.next = 41;
               break;
             }
-            return _context.abrupt("return", route$7(req, config));
-          case 8:
-            if (!matches$5(configRoutes, req)) {
-              _context.next = 10;
+            throw new Error('authentication failed');
+          case 41:
+            info('Server login successful');
+            _ref3 = (_exec = /(nile\.session-token=.+?);/.exec(authCookie)) != null ? _exec : [], token = _ref3[1];
+            return _context.abrupt("return", new Headers({
+              cookie: [token, csrfCookie].join('; ')
+            }));
+          case 44:
+          case "end":
+            return _context.stop();
+        }
+      }, _callee);
+    }));
+    function login(_x) {
+      return _login.apply(this, arguments);
+    }
+    return login;
+  }();
+}
+
+var Requester = /*#__PURE__*/function (_Config) {
+  function Requester(config) {
+    return _Config.call(this, config) || this;
+  }
+  _inheritsLoose(Requester, _Config);
+  var _proto = Requester.prototype;
+  _proto.rawRequest = /*#__PURE__*/function () {
+    var _rawRequest = /*#__PURE__*/_asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(method, url, init, body) {
+      var _init, res;
+      return _regeneratorRuntime().wrap(function _callee$(_context) {
+        while (1) switch (_context.prev = _context.next) {
+          case 0:
+            _init = _extends({}, init, {
+              body: body,
+              method: method
+            });
+            _context.next = 3;
+            return _fetch(this, url, _init);
+          case 3:
+            res = _context.sent;
+            if (!(res instanceof ResponseError)) {
+              _context.next = 6;
               break;
             }
-            return _context.abrupt("return", route$5(req));
-          case 10:
-            if (!matches$6(configRoutes, req)) {
-              _context.next = 12;
+            return _context.abrupt("return", res.response);
+          case 6:
+            return _context.abrupt("return", res);
+          case 7:
+          case "end":
+            return _context.stop();
+        }
+      }, _callee, this);
+    }));
+    function rawRequest(_x, _x2, _x3, _x4) {
+      return _rawRequest.apply(this, arguments);
+    }
+    return rawRequest;
+  }()
+  /**
+   * three options here
+   * 1) pass in headers for a server side request
+   * 2) pass in the payload that matches the api
+   * 3) pass in the request object sent by a browser
+   * @param method
+   * @param url
+   * @param req
+   * @param init
+   * @returns
+   */
+  ;
+  _proto.request =
+  /*#__PURE__*/
+  function () {
+    var _request = /*#__PURE__*/_asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(method, url, req, init) {
+      var headers, tenantId, cookie, _headers, _tenantId, _cookie, body, _init;
+      return _regeneratorRuntime().wrap(function _callee2$(_context2) {
+        while (1) switch (_context2.prev = _context2.next) {
+          case 0:
+            // set the headers
+            headers = new Headers(init ? init == null ? void 0 : init.headers : {});
+            if (req instanceof Headers) {
+              tenantId = req.get(X_NILE_TENANT);
+              cookie = req.get('cookie');
+              if (tenantId) {
+                headers.set(X_NILE_TENANT, tenantId);
+              }
+              if (cookie) {
+                headers.set('cookie', cookie);
+              }
+            } else if (req instanceof Request) {
+              // pass back the X_NILE_TENANT
+              _headers = new Headers(req == null ? void 0 : req.headers);
+              _tenantId = _headers.get(X_NILE_TENANT);
+              _cookie = _headers.get('cookie');
+              if (_tenantId) {
+                headers.set(X_NILE_TENANT, _tenantId);
+              }
+              if (_cookie) {
+                headers.set('cookie', _cookie);
+              }
+            }
+            // default the body - may be the actual payload for the API
+            body = JSON.stringify(req); // comes from next/some server
+            if (!(method === 'GET')) {
+              _context2.next = 7;
               break;
             }
-            return _context.abrupt("return", route$6(req));
-          case 12:
-            if (!matches$4(configRoutes, req)) {
-              _context.next = 14;
+            body = undefined;
+            _context2.next = 14;
+            break;
+          case 7:
+            if (!(req instanceof Request)) {
+              _context2.next = 13;
               break;
             }
-            return _context.abrupt("return", route$4(req));
+            _context2.next = 10;
+            return new Response(req.body).text();
+          case 10:
+            body = _context2.sent;
+            _context2.next = 14;
+            break;
+          case 13:
+            if (
+            // is just headers for a GET request
+            req instanceof Headers || JSON.stringify(req) === '{}' || req && typeof req === 'object' && Object.values(req).length === 0) {
+              body = undefined;
+            }
           case 14:
-            if (!matches$3(configRoutes, req)) {
-              _context.next = 16;
+            _init = _extends({}, init, {
+              headers: headers
+            });
+            _context2.next = 17;
+            return this.rawRequest(method, url, _init, body);
+          case 17:
+            return _context2.abrupt("return", _context2.sent);
+          case 18:
+          case "end":
+            return _context2.stop();
+        }
+      }, _callee2, this);
+    }));
+    function request(_x5, _x6, _x7, _x8) {
+      return _request.apply(this, arguments);
+    }
+    return request;
+  }();
+  _proto.post = /*#__PURE__*/function () {
+    var _post = /*#__PURE__*/_asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee3(req, url, init) {
+      var response;
+      return _regeneratorRuntime().wrap(function _callee3$(_context3) {
+        while (1) switch (_context3.prev = _context3.next) {
+          case 0:
+            _context3.next = 2;
+            return this.request('POST', url, req, init);
+          case 2:
+            response = _context3.sent;
+            if (!(response && response.status >= 200 && response.status < 300)) {
+              _context3.next = 5;
               break;
             }
-            return _context.abrupt("return", route$3(req));
-          case 16:
-            if (!matches$2(configRoutes, req)) {
-              _context.next = 18;
+            return _context3.abrupt("return", response.json());
+          case 5:
+            return _context3.abrupt("return", response);
+          case 6:
+          case "end":
+            return _context3.stop();
+        }
+      }, _callee3, this);
+    }));
+    function post(_x9, _x10, _x11) {
+      return _post.apply(this, arguments);
+    }
+    return post;
+  }();
+  _proto.get = /*#__PURE__*/function () {
+    var _get = /*#__PURE__*/_asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee4(req, url, init) {
+      var response;
+      return _regeneratorRuntime().wrap(function _callee4$(_context4) {
+        while (1) switch (_context4.prev = _context4.next) {
+          case 0:
+            _context4.next = 2;
+            return this.request('GET', url, req, init);
+          case 2:
+            response = _context4.sent;
+            if (!(response && response.status >= 200 && response.status < 300)) {
+              _context4.next = 5;
               break;
             }
-            return _context.abrupt("return", route$2(req));
-          case 18:
-            if (!matches$1(configRoutes, req)) {
-              _context.next = 20;
+            return _context4.abrupt("return", response.json());
+          case 5:
+            return _context4.abrupt("return", response);
+          case 6:
+          case "end":
+            return _context4.stop();
+        }
+      }, _callee4, this);
+    }));
+    function get(_x12, _x13, _x14) {
+      return _get.apply(this, arguments);
+    }
+    return get;
+  }();
+  _proto.put = /*#__PURE__*/function () {
+    var _put = /*#__PURE__*/_asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee5(req, url, init) {
+      var response;
+      return _regeneratorRuntime().wrap(function _callee5$(_context5) {
+        while (1) switch (_context5.prev = _context5.next) {
+          case 0:
+            _context5.next = 2;
+            return this.request('PUT', url, req, init);
+          case 2:
+            response = _context5.sent;
+            if (!(response && response.status >= 200 && response.status < 300)) {
+              _context5.next = 5;
               break;
             }
-            return _context.abrupt("return", route$1(req));
-          case 20:
-            if (!matches(configRoutes, req)) {
-              _context.next = 22;
+            return _context5.abrupt("return", response.json());
+          case 5:
+            return _context5.abrupt("return", response);
+          case 6:
+          case "end":
+            return _context5.stop();
+        }
+      }, _callee5, this);
+    }));
+    function put(_x15, _x16, _x17) {
+      return _put.apply(this, arguments);
+    }
+    return put;
+  }();
+  _proto["delete"] = /*#__PURE__*/function () {
+    var _delete2 = /*#__PURE__*/_asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee6(req, url, init) {
+      var response;
+      return _regeneratorRuntime().wrap(function _callee6$(_context6) {
+        while (1) switch (_context6.prev = _context6.next) {
+          case 0:
+            _context6.next = 2;
+            return this.request('DELETE', url, req, init);
+          case 2:
+            response = _context6.sent;
+            if (!(response && response.status >= 200 && response.status < 300)) {
+              _context6.next = 5;
               break;
             }
-            return _context.abrupt("return", route(req));
-          case 22:
-            return _context.abrupt("return", new Response(null, {
-              status: 404
-            }));
-          case 23:
+            return _context6.abrupt("return", response.json());
+          case 5:
+            return _context6.abrupt("return", response);
+          case 6:
           case "end":
-            return _context.stop();
+            return _context6.stop();
         }
-      }, _callee);
+      }, _callee6, this);
     }));
-    function GET(_x) {
-      return _GET.apply(this, arguments);
+    function _delete(_x18, _x19, _x20) {
+      return _delete2.apply(this, arguments);
+    }
+    return _delete;
+  }();
+  return Requester;
+}(Config);
+
+var Tenants = /*#__PURE__*/function (_Config) {
+  function Tenants(config, headers) {
+    var _this;
+    _this = _Config.call(this, config) || this;
+    _this.headers = void 0;
+    _this.createTenant = /*#__PURE__*/function () {
+      var _ref = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req, init) {
+        var _req, _requester, _init;
+        return _regeneratorRuntime().wrap(function _callee$(_context) {
+          while (1) switch (_context.prev = _context.next) {
+            case 0:
+              if (typeof req === 'string') {
+                _req = new Request("" + _this.api.basePath + _this.tenantsUrl, {
+                  body: JSON.stringify({
+                    name: req
+                  }),
+                  method: 'POST'
+                });
+              } else {
+                _req = req;
+              }
+              _requester = new Requester(_this);
+              _init = _this.handleHeaders(init);
+              return _context.abrupt("return", _requester.post(_req, _this.tenantsUrl, _init));
+            case 4:
+            case "end":
+              return _context.stop();
+          }
+        }, _callee);
+      }));
+      return function (_x, _x2) {
+        return _ref.apply(this, arguments);
+      };
+    }();
+    _this.getTenant = /*#__PURE__*/function () {
+      var _ref2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(req, init) {
+        var _requester, _init;
+        return _regeneratorRuntime().wrap(function _callee2$(_context2) {
+          while (1) switch (_context2.prev = _context2.next) {
+            case 0:
+              if (typeof req === 'string') {
+                _this.tenantId = req;
+              }
+              _requester = new Requester(_this);
+              _init = _this.handleHeaders(init);
+              return _context2.abrupt("return", _requester.get(req, _this.tenantUrl, _init));
+            case 4:
+            case "end":
+              return _context2.stop();
+          }
+        }, _callee2);
+      }));
+      return function (_x3, _x4) {
+        return _ref2.apply(this, arguments);
+      };
+    }();
+    _this.listTenants = /*#__PURE__*/function () {
+      var _ref3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee3(req, init) {
+        var _requester, _init;
+        return _regeneratorRuntime().wrap(function _callee3$(_context3) {
+          while (1) switch (_context3.prev = _context3.next) {
+            case 0:
+              _requester = new Requester(_this);
+              _init = _this.handleHeaders(init);
+              return _context3.abrupt("return", _requester.get(req, _this.tenantListUrl, _init));
+            case 3:
+            case "end":
+              return _context3.stop();
+          }
+        }, _callee3);
+      }));
+      return function (_x5, _x6) {
+        return _ref3.apply(this, arguments);
+      };
+    }();
+    _this.headers = headers;
+    return _this;
+  }
+  _inheritsLoose(Tenants, _Config);
+  var _proto = Tenants.prototype;
+  _proto.handleHeaders = function handleHeaders(init) {
+    if (this.headers) {
+      if (init) {
+        var _init2;
+        init.headers = new Headers(_extends({}, this.headers, (_init2 = init) == null ? void 0 : _init2.headers));
+        return init;
+      } else {
+        init = {
+          headers: this.headers
+        };
+        return init;
+      }
+    }
+    return undefined;
+  };
+  return _createClass(Tenants, [{
+    key: "tenantsUrl",
+    get: function get() {
+      return '/tenants';
+    }
+  }, {
+    key: "tenantUrl",
+    get: function get() {
+      var _this$tenantId;
+      return "/tenants/" + ((_this$tenantId = this.tenantId) != null ? _this$tenantId : '{tenantId}');
+    }
+  }, {
+    key: "tenantListUrl",
+    get: function get() {
+      var _this$userId;
+      return "/users/" + ((_this$userId = this.userId) != null ? _this$userId : '{userId}') + "/tenants";
+    }
+  }]);
+}(Config);
+
+var Users = /*#__PURE__*/function (_Config) {
+  function Users(config, headers) {
+    var _this;
+    _this = _Config.call(this, config) || this;
+    _this.headers = void 0;
+    _this.createUser = /*#__PURE__*/function () {
+      var _ref = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req, init) {
+        var _requester, _init;
+        return _regeneratorRuntime().wrap(function _callee$(_context) {
+          while (1) switch (_context.prev = _context.next) {
+            case 0:
+              _requester = new Requester(_this);
+              _init = _this.handleHeaders(init);
+              _context.next = 4;
+              return _requester.post(req, _this.usersUrl, _init);
+            case 4:
+              return _context.abrupt("return", _context.sent);
+            case 5:
+            case "end":
+              return _context.stop();
+          }
+        }, _callee);
+      }));
+      return function (_x, _x2) {
+        return _ref.apply(this, arguments);
+      };
+    }();
+    _this.updateUser = /*#__PURE__*/function () {
+      var _ref2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(userId, req, init) {
+        var _requester, _init;
+        return _regeneratorRuntime().wrap(function _callee2$(_context2) {
+          while (1) switch (_context2.prev = _context2.next) {
+            case 0:
+              _requester = new Requester(_this);
+              _init = _this.handleHeaders(init);
+              _context2.next = 4;
+              return _requester.put(req, _this.usersUrl + "/" + userId, _init);
+            case 4:
+              return _context2.abrupt("return", _context2.sent);
+            case 5:
+            case "end":
+              return _context2.stop();
+          }
+        }, _callee2);
+      }));
+      return function (_x3, _x4, _x5) {
+        return _ref2.apply(this, arguments);
+      };
+    }();
+    _this.listUsers = /*#__PURE__*/function () {
+      var _ref3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee3(req, init) {
+        var _requester, _init;
+        return _regeneratorRuntime().wrap(function _callee3$(_context3) {
+          while (1) switch (_context3.prev = _context3.next) {
+            case 0:
+              _requester = new Requester(_this);
+              _init = _this.handleHeaders(init);
+              _context3.next = 4;
+              return _requester.get(req, _this.tenantUsersUrl, _init);
+            case 4:
+              return _context3.abrupt("return", _context3.sent);
+            case 5:
+            case "end":
+              return _context3.stop();
+          }
+        }, _callee3);
+      }));
+      return function (_x6, _x7) {
+        return _ref3.apply(this, arguments);
+      };
+    }();
+    _this.linkUser = /*#__PURE__*/function () {
+      var _ref4 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee4(req, init) {
+        var _requester, _init;
+        return _regeneratorRuntime().wrap(function _callee4$(_context4) {
+          while (1) switch (_context4.prev = _context4.next) {
+            case 0:
+              _requester = new Requester(_this);
+              _init = _this.handleHeaders(init);
+              _context4.next = 4;
+              return _requester.put(req, _this.tenantUsersUrl, _init);
+            case 4:
+              return _context4.abrupt("return", _context4.sent);
+            case 5:
+            case "end":
+              return _context4.stop();
+          }
+        }, _callee4);
+      }));
+      return function (_x8, _x9) {
+        return _ref4.apply(this, arguments);
+      };
+    }();
+    _this.tenantUsersDeleteUrl = function (userId) {
+      var _this$tenantId;
+      return "/tenants/" + ((_this$tenantId = _this.tenantId) != null ? _this$tenantId : '{tenantId}') + "/users/" + (userId != null ? userId : '{userId}');
+    };
+    _this.getUserId = /*#__PURE__*/function () {
+      var _ref5 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee5(req) {
+        var body;
+        return _regeneratorRuntime().wrap(function _callee5$(_context5) {
+          while (1) switch (_context5.prev = _context5.next) {
+            case 0:
+              if (!(req instanceof Request)) {
+                _context5.next = 6;
+                break;
+              }
+              _context5.next = 3;
+              return new Response(req == null ? void 0 : req.body).json();
+            case 3:
+              body = _context5.sent;
+              if (!body) {
+                _context5.next = 6;
+                break;
+              }
+              return _context5.abrupt("return", body.id);
+            case 6:
+              if (!('id' in req)) {
+                _context5.next = 8;
+                break;
+              }
+              return _context5.abrupt("return", req.id);
+            case 8:
+              return _context5.abrupt("return", null);
+            case 9:
+            case "end":
+              return _context5.stop();
+          }
+        }, _callee5);
+      }));
+      return function (_x10) {
+        return _ref5.apply(this, arguments);
+      };
+    }();
+    _this.unlinkUser = /*#__PURE__*/function () {
+      var _ref6 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee6(req, init) {
+        var _requester, userId, _init;
+        return _regeneratorRuntime().wrap(function _callee6$(_context6) {
+          while (1) switch (_context6.prev = _context6.next) {
+            case 0:
+              _requester = new Requester(_this);
+              _context6.next = 3;
+              return _this.getUserId(req);
+            case 3:
+              userId = _context6.sent;
+              _init = _this.handleHeaders(init);
+              _context6.next = 7;
+              return _requester["delete"](req, _this.tenantUsersDeleteUrl(userId), _init);
+            case 7:
+              return _context6.abrupt("return", _context6.sent);
+            case 8:
+            case "end":
+              return _context6.stop();
+          }
+        }, _callee6);
+      }));
+      return function (_x11, _x12) {
+        return _ref6.apply(this, arguments);
+      };
+    }();
+    _this.me = /*#__PURE__*/function () {
+      var _ref7 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee7(req, init) {
+        var _requester, _init;
+        return _regeneratorRuntime().wrap(function _callee7$(_context7) {
+          while (1) switch (_context7.prev = _context7.next) {
+            case 0:
+              _requester = new Requester(_this);
+              _init = _this.handleHeaders(init);
+              _context7.next = 4;
+              return _requester.get(req, _this.meUrl, _init);
+            case 4:
+              return _context7.abrupt("return", _context7.sent);
+            case 5:
+            case "end":
+              return _context7.stop();
+          }
+        }, _callee7);
+      }));
+      return function (_x13, _x14) {
+        return _ref7.apply(this, arguments);
+      };
+    }();
+    _this.headers = headers;
+    return _this;
+  }
+  _inheritsLoose(Users, _Config);
+  var _proto = Users.prototype;
+  _proto.handleHeaders = function handleHeaders(init) {
+    if (this.headers) {
+      if (init) {
+        var _init2;
+        init.headers = new Headers(_extends({}, this.headers, (_init2 = init) == null ? void 0 : _init2.headers));
+        return init;
+      } else {
+        init = {
+          headers: this.headers
+        };
+        return init;
+      }
     }
-    return GET;
-  }();
-}
-
-function POSTER(configRoutes, config) {
-  return /*#__PURE__*/function () {
-    var _POST = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
-      return _regeneratorRuntime().wrap(function _callee$(_context) {
-        while (1) switch (_context.prev = _context.next) {
-          case 0:
-            if (!matches$8(configRoutes, req)) {
-              _context.next = 2;
-              break;
-            }
-            return _context.abrupt("return", route$8(req, config));
-          case 2:
-            if (!matches$9(configRoutes, req)) {
-              _context.next = 4;
-              break;
-            }
-            return _context.abrupt("return", route$9(req, config));
-          case 4:
-            if (!matches$7(configRoutes, req)) {
-              _context.next = 6;
-              break;
-            }
-            return _context.abrupt("return", route$7(req, config));
-          case 6:
-            if (!matches$5(configRoutes, req)) {
-              _context.next = 8;
-              break;
-            }
-            return _context.abrupt("return", route$5(req));
-          case 8:
-            if (!matches$6(configRoutes, req)) {
-              _context.next = 10;
-              break;
-            }
-            return _context.abrupt("return", route$6(req));
-          case 10:
-            if (!matches$4(configRoutes, req)) {
-              _context.next = 12;
-              break;
-            }
-            return _context.abrupt("return", route$4(req));
-          case 12:
-            if (!matches$3(configRoutes, req)) {
-              _context.next = 14;
-              break;
-            }
-            return _context.abrupt("return", route$3(req));
-          case 14:
-            if (!matches$2(configRoutes, req)) {
-              _context.next = 16;
-              break;
-            }
-            return _context.abrupt("return", route$2(req));
-          case 16:
-            if (!matches$1(configRoutes, req)) {
-              _context.next = 18;
-              break;
-            }
-            return _context.abrupt("return", route$1(req));
-          case 18:
-            return _context.abrupt("return", new Response(null, {
-              status: 404
-            }));
-          case 19:
-          case "end":
-            return _context.stop();
-        }
-      }, _callee);
-    }));
-    function POST(_x) {
-      return _POST.apply(this, arguments);
+    return undefined;
+  };
+  return _createClass(Users, [{
+    key: "usersUrl",
+    get: function get() {
+      return '/users';
     }
-    return POST;
-  }();
-}
-
-function DELETER(configRoutes, config) {
-  return /*#__PURE__*/function () {
-    var _DELETE = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
-      return _regeneratorRuntime().wrap(function _callee$(_context) {
-        while (1) switch (_context.prev = _context.next) {
-          case 0:
-            if (!matches$8(configRoutes, req)) {
-              _context.next = 2;
-              break;
-            }
-            return _context.abrupt("return", route$8(req, config));
-          case 2:
-            if (!matches$7(configRoutes, req)) {
-              _context.next = 4;
-              break;
-            }
-            return _context.abrupt("return", route$7(req, config));
-          case 4:
-            return _context.abrupt("return", new Response(null, {
-              status: 404
-            }));
-          case 5:
-          case "end":
-            return _context.stop();
-        }
-      }, _callee);
-    }));
-    function DELETE(_x) {
-      return _DELETE.apply(this, arguments);
+  }, {
+    key: "tenantUsersUrl",
+    get: function get() {
+      var _this$tenantId2;
+      return "/tenants/" + ((_this$tenantId2 = this.tenantId) != null ? _this$tenantId2 : '{tenantId}') + "/users";
     }
-    return DELETE;
-  }();
-}
-
-function PUTER(configRoutes, config) {
-  return /*#__PURE__*/function () {
-    var _PUT = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
-      return _regeneratorRuntime().wrap(function _callee$(_context) {
-        while (1) switch (_context.prev = _context.next) {
-          case 0:
-            if (!matches$8(configRoutes, req)) {
-              _context.next = 2;
-              break;
-            }
-            return _context.abrupt("return", route$8(req, config));
-          case 2:
-            if (!matches$9(configRoutes, req)) {
-              _context.next = 4;
-              break;
-            }
-            return _context.abrupt("return", route$9(req, config));
-          case 4:
-            if (!matches$7(configRoutes, req)) {
-              _context.next = 6;
-              break;
-            }
-            return _context.abrupt("return", route$7(req, config));
-          case 6:
-            return _context.abrupt("return", new Response(null, {
-              status: 404
-            }));
-          case 7:
-          case "end":
-            return _context.stop();
-        }
-      }, _callee);
-    }));
-    function PUT(_x) {
-      return _PUT.apply(this, arguments);
+  }, {
+    key: "meUrl",
+    get: function get() {
+      return '/me';
     }
-    return PUT;
-  }();
-}
-
-function Handlers(configRoutes, config) {
-  var GET = GETTER(configRoutes, config);
-  var POST = POSTER(configRoutes, config);
-  var DELETE = DELETER(configRoutes, config);
-  var PUT = PUTER(configRoutes, config);
-  return {
-    GET: GET,
-    POST: POST,
-    DELETE: DELETE,
-    PUT: PUT
-  };
-}
+  }]);
+}(Config);
 
 var Api = /*#__PURE__*/function () {
   function Api(config) {
@@ -3693,6 +3820,7 @@ var Api = /*#__PURE__*/function () {
     }
   }]);
 }();
+
 var Server = /*#__PURE__*/function () {
   function Server(config) {
     var _this = this;
@@ -3714,32 +3842,32 @@ var Server = /*#__PURE__*/function () {
       _this.token = token;
     });
   }
-  var _proto2 = Server.prototype;
-  _proto2.setConfig = function setConfig(cfg) {
+  var _proto = Server.prototype;
+  _proto.setConfig = function setConfig(cfg) {
     this.config = new Config(cfg);
   };
-  _proto2.init = /*#__PURE__*/function () {
-    var _init = /*#__PURE__*/_asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(cfg) {
+  _proto.init = /*#__PURE__*/function () {
+    var _init = /*#__PURE__*/_asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(cfg) {
       var updatedConfig;
-      return _regeneratorRuntime().wrap(function _callee2$(_context2) {
-        while (1) switch (_context2.prev = _context2.next) {
+      return _regeneratorRuntime().wrap(function _callee$(_context) {
+        while (1) switch (_context.prev = _context.next) {
           case 0:
-            _context2.next = 2;
+            _context.next = 2;
             return this.config.configure(_extends({}, this.config, cfg));
           case 2:
-            updatedConfig = _context2.sent;
+            updatedConfig = _context.sent;
             this.setConfig(updatedConfig);
             this.manager.clear(this.config);
             this.manager = new DBManager(this.config);
             this.api = new Api(this.config);
-            return _context2.abrupt("return", this);
+            return _context.abrupt("return", this);
           case 8:
           case "end":
-            return _context2.stop();
+            return _context.stop();
         }
-      }, _callee2, this);
+      }, _callee, this);
     }));
-    function init(_x2) {
+    function init(_x) {
       return _init.apply(this, arguments);
     }
     return init;
@@ -3749,7 +3877,7 @@ var Server = /*#__PURE__*/function () {
    * returns the global Server object, an existing server that's already been configured,
    * or a new one if the config isn't in the cache
    */
-  _proto2.getInstance = function getInstance(config) {
+  _proto.getInstance = function getInstance(config) {
     var _config = _extends({}, this.config, config);
     var serverId = getServerId(_config);
     var currentServerId = makeServerId(this.config);
@@ -3768,8 +3896,9 @@ var Server = /*#__PURE__*/function () {
       existing.databaseId = updatedConfig.databaseId;
       return existing;
     }
-    this.servers.set(serverId, new Server(_config));
-    return this.servers.get(serverId);
+    var newServer = new Server(_config);
+    this.servers.set(serverId, newServer);
+    return newServer;
   };
   return _createClass(Server, [{
     key: "databaseId",
@@ -3824,30 +3953,29 @@ var Server = /*#__PURE__*/function () {
   }, {
     key: "db",
     get: function get() {
-      // only need to interact with the knex object
       return this.manager.getConnection(this.config);
     }
   }]);
 }();
-function create(_x3) {
+function create(_x2) {
   return _create.apply(this, arguments);
 }
 function _create() {
-  _create = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee3(config) {
+  _create = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(config) {
     var server;
-    return _regeneratorRuntime().wrap(function _callee3$(_context3) {
-      while (1) switch (_context3.prev = _context3.next) {
+    return _regeneratorRuntime().wrap(function _callee2$(_context2) {
+      while (1) switch (_context2.prev = _context2.next) {
         case 0:
           server = new Server(config);
-          _context3.next = 3;
+          _context2.next = 3;
           return server.init();
         case 3:
-          return _context3.abrupt("return", _context3.sent);
+          return _context2.abrupt("return", _context2.sent);
         case 4:
         case "end":
-          return _context3.stop();
+          return _context2.stop();
       }
-    }, _callee3);
+    }, _callee2);
   }));
   return _create.apply(this, arguments);
 }