@object-ui/auth 16.1.0 → 17.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +210 -0
- package/dist/AuthContext.d.ts +14 -2
- package/dist/AuthContext.d.ts.map +1 -1
- package/dist/AuthProvider.d.ts.map +1 -1
- package/dist/AuthProvider.js +8 -1
- package/dist/createAuthClient.d.ts.map +1 -1
- package/dist/createAuthClient.js +37 -0
- package/dist/index.d.ts +2 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +6 -0
- package/dist/org-roles.d.ts +93 -0
- package/dist/org-roles.d.ts.map +1 -0
- package/dist/org-roles.js +137 -0
- package/dist/types.d.ts +65 -0
- package/dist/types.d.ts.map +1 -1
- package/dist/useAuth.d.ts.map +1 -1
- package/dist/useAuth.js +1 -0
- package/package.json +5 -4
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,215 @@
|
|
|
1
1
|
# @object-ui/auth
|
|
2
2
|
|
|
3
|
+
## 17.1.0
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- fc60ad3: refactor(auth): derive the org-role vocabulary from `@objectstack/spec` instead of mirroring it
|
|
8
|
+
|
|
9
|
+
`org-roles.ts` restated the four membership-role names that `@objectstack/spec`
|
|
10
|
+
owns as `BUILTIN_MEMBERSHIP_ROLES`. That was a mirror for packaging reasons
|
|
11
|
+
only: this package took no dependency on the spec, and no published spec
|
|
12
|
+
carried the constants. Both blockers are gone — `@objectstack/spec@17.0.0-rc.0`
|
|
13
|
+
ships ADR-0108's closed vocabulary and the workspace already pins
|
|
14
|
+
`^17.0.0-rc.0` — so the four `ORG_ROLE_*` constants are now re-exports,
|
|
15
|
+
`OrgRole` is `BuiltinMembershipRole`, and `ORG_ROLES` is
|
|
16
|
+
`[...BUILTIN_MEMBERSHIP_ROLES]`. The list cannot drift from what the server's
|
|
17
|
+
enforced `select` accepts, by construction.
|
|
18
|
+
|
|
19
|
+
Deliberately still local: `ORG_ROLE_LABELS` and the grade ladder
|
|
20
|
+
(`orgRoleGrade` / `invitableOrgRoles` / `assignableOrgRoles`). They are console
|
|
21
|
+
concerns — i18n keys and screen-narrowing rules — and folding them into the
|
|
22
|
+
name list would be the modeling error ADR-0108 D4 warns about: _what names
|
|
23
|
+
exist_ is a list; _which names mean authority_ and _how a name projects_ are
|
|
24
|
+
rules that belong next to what they govern.
|
|
25
|
+
|
|
26
|
+
The #2907 drift guard (`is EXACTLY the framework four`) is dropped — a derived
|
|
27
|
+
list cannot drift, and asserting a re-export against a literal is noise. No
|
|
28
|
+
behaviour changes: the four names, their display order, and their labels are
|
|
29
|
+
exactly what they already were.
|
|
30
|
+
|
|
31
|
+
- Updated dependencies [9e7349e]
|
|
32
|
+
- Updated dependencies [8864971]
|
|
33
|
+
- Updated dependencies [b41f401]
|
|
34
|
+
- Updated dependencies [19e9fa0]
|
|
35
|
+
- Updated dependencies [38ca8be]
|
|
36
|
+
- Updated dependencies [4952edf]
|
|
37
|
+
- Updated dependencies [7f0252e]
|
|
38
|
+
- Updated dependencies [7639a61]
|
|
39
|
+
- Updated dependencies [94e63ef]
|
|
40
|
+
- Updated dependencies [c4db402]
|
|
41
|
+
- Updated dependencies [5319bf1]
|
|
42
|
+
- Updated dependencies [49e5671]
|
|
43
|
+
- Updated dependencies [b5b97e2]
|
|
44
|
+
- Updated dependencies [f59f2c1]
|
|
45
|
+
- Updated dependencies [4874117]
|
|
46
|
+
- Updated dependencies [ce08d55]
|
|
47
|
+
- Updated dependencies [2374a49]
|
|
48
|
+
- Updated dependencies [ea7f477]
|
|
49
|
+
- Updated dependencies [7f23cd0]
|
|
50
|
+
- Updated dependencies [24e0e0a]
|
|
51
|
+
- Updated dependencies [3a6cf24]
|
|
52
|
+
- Updated dependencies [aa35561]
|
|
53
|
+
- Updated dependencies [03bd53b]
|
|
54
|
+
- Updated dependencies [3c1f321]
|
|
55
|
+
- Updated dependencies [a045a32]
|
|
56
|
+
- Updated dependencies [912496d]
|
|
57
|
+
- Updated dependencies [9867281]
|
|
58
|
+
- @object-ui/types@17.1.0
|
|
59
|
+
|
|
60
|
+
## 17.0.0
|
|
61
|
+
|
|
62
|
+
### Minor Changes
|
|
63
|
+
|
|
64
|
+
- 8b4bc94: feat(console): group tenancy posture affordances — org switcher as write
|
|
65
|
+
context + org attribution in read views (framework ADR-0105 Phase 1)
|
|
66
|
+
|
|
67
|
+
Under the new `group` tenancy posture the server widens reads to every
|
|
68
|
+
organization the member belongs to (`organization_id IN accessible_org_ids`)
|
|
69
|
+
while writes land in the ACTIVE organization — so the console's existing
|
|
70
|
+
"which org am I in = which org's data I see" presentation becomes wrong the
|
|
71
|
+
moment a deployment switches postures. The ADR requires these affordances to
|
|
72
|
+
land WITH Phase 1, not after.
|
|
73
|
+
|
|
74
|
+
- `@object-ui/auth`: `AuthPublicConfig.features.tenancyPosture`
|
|
75
|
+
(`'single' | 'group' | 'isolated'`, exported as `TenancyPosture`) mirrors
|
|
76
|
+
the server's public auth config key. It gates nothing — `multiOrgEnabled`
|
|
77
|
+
stays the capability flag; this only tells the console how to render org
|
|
78
|
+
context.
|
|
79
|
+
- `useTenancyPosture()` (app-shell): reads the posture from the cached auth
|
|
80
|
+
config fetch; `undefined` (older server, unrecognized value, fetch failure)
|
|
81
|
+
keeps every group affordance off, so non-group deployments render
|
|
82
|
+
pixel-identical to today.
|
|
83
|
+
- `WorkspaceSwitcher`: under `group` the dropdown labels the active org
|
|
84
|
+
"Working organization" and explains the split — new records are created
|
|
85
|
+
here, views show data from all your organizations.
|
|
86
|
+
- `RecordFormPage` (create mode): org-walled objects show a "Creates in
|
|
87
|
+
<active org>" badge naming the engine's write target (ADR-0105 D5 stamps
|
|
88
|
+
`organization_id` from the active org).
|
|
89
|
+
- Default list columns (`ObjectView`, `InterfaceListPage`, `ObjectDataPage`):
|
|
90
|
+
under `group`, org-walled objects get a TRAILING `organization_id`
|
|
91
|
+
attribution column so cross-org rows are attributable at a glance.
|
|
92
|
+
Render-time only — never persisted into saved view/page metadata, and
|
|
93
|
+
business fields still lead.
|
|
94
|
+
|
|
95
|
+
- 54886ca: feat(console): make the `delegated_admin` org role reachable, and narrow both role pickers to what the server will accept (framework#3697)
|
|
96
|
+
|
|
97
|
+
The framework registered a fourth organization role — `delegated_admin`, the
|
|
98
|
+
grade that may reach `/organization/invite-member` **without** being an org
|
|
99
|
+
admin, which is what finally gives ADR-0105 D8's scope-bounded issuance gate a
|
|
100
|
+
caller. objectui#2868 already shipped the placement half of that UX (units and
|
|
101
|
+
positions narrowed by `describeDelegableScope()`), but the console could not
|
|
102
|
+
select the role in the first place: `MembersPage` and `InviteMemberDialog` each
|
|
103
|
+
inlined `type Role = 'owner' | 'admin' | 'member'`, so the capability the
|
|
104
|
+
framework grew was unreachable from either screen.
|
|
105
|
+
|
|
106
|
+
**One vocabulary, not two.** The role names, labels and narrowing rules now live
|
|
107
|
+
in `@object-ui/auth`'s new `org-roles` module (`ORG_ROLES`, `ORG_ROLE_LABELS`,
|
|
108
|
+
`orgRoleGrade`, `invitableOrgRoles`, `assignableOrgRoles`) and both screens
|
|
109
|
+
consume it. Note this list still **mirrors** the server rather than deriving
|
|
110
|
+
from it — `/auth/config` publishes feature flags but no role vocabulary, so
|
|
111
|
+
there is no surface to read; objectstack-ai/objectstack#3723 tracks making one
|
|
112
|
+
list the source for all of them. Until then a server-side role addition means
|
|
113
|
+
one console edit instead of two.
|
|
114
|
+
|
|
115
|
+
**The pickers now narrow, the way the placement picker already does.** Both
|
|
116
|
+
mirror a _different_ server gate, and offering an option the server would refuse
|
|
117
|
+
is the failure they prevent:
|
|
118
|
+
|
|
119
|
+
- **Invite role** ← the framework's `beforeCreateInvitation` role cap: never
|
|
120
|
+
above the issuer's own grade, and an issuer below admin grade may invite as
|
|
121
|
+
`member` only. A `delegated_admin` who picked "Admin" would have been refused
|
|
122
|
+
with a 403; that option is simply no longer offered.
|
|
123
|
+
- **Change role** ← better-auth's `update-member-role` route: it requires the
|
|
124
|
+
`member:["update"]` permission (owner/admin only — `delegated_admin` is built
|
|
125
|
+
from `memberAc` and holds `member: []`), and only an owner may set `owner` or
|
|
126
|
+
re-role an existing owner. An actor who may re-role nobody now gets no items
|
|
127
|
+
instead of three that would 403.
|
|
128
|
+
|
|
129
|
+
Narrowing is convenience, not the boundary — the server re-checks every one of
|
|
130
|
+
these — and it fails toward _less_: an unresolved membership offers `member`
|
|
131
|
+
alone on invite, and nothing on re-role.
|
|
132
|
+
|
|
133
|
+
An ordinary invitation is unchanged: with the default role and no placement, the
|
|
134
|
+
request body is byte-identical to before.
|
|
135
|
+
|
|
136
|
+
Note for translators: `organization.roles.*` has never been defined in any
|
|
137
|
+
locale bundle — all four labels (owner/admin/member included) resolve through
|
|
138
|
+
their `defaultValue` English fallback. The new role follows the same pattern
|
|
139
|
+
rather than being the only localized one.
|
|
140
|
+
|
|
141
|
+
- b5609cb: feat(console): scoped-invitation placement — invite someone straight into a
|
|
142
|
+
business unit and positions (framework ADR-0105 D8)
|
|
143
|
+
|
|
144
|
+
An invitation may now carry PLACEMENT INTENT: the business unit the invitee
|
|
145
|
+
lands in and the positions they are assigned when they accept. A plant admin's
|
|
146
|
+
invitee arrives already in the right unit and role instead of waiting on a
|
|
147
|
+
platform admin to finish the job by hand.
|
|
148
|
+
|
|
149
|
+
- `@object-ui/auth`: `inviteMember` accepts optional `businessUnitId` /
|
|
150
|
+
`positions` (passed through better-auth's invitation `additionalFields`), and
|
|
151
|
+
a new `describeDelegableScope()` reads
|
|
152
|
+
`GET /api/v1/security/my-delegable-scope`.
|
|
153
|
+
- `InviteMemberDialog`: an optional "Placement" section listing **only** the
|
|
154
|
+
units the issuer may place into and the positions they may hand out.
|
|
155
|
+
Positions appear once a unit is chosen — an unanchored assignment is refused
|
|
156
|
+
by the server, so offering it first would mislead.
|
|
157
|
+
|
|
158
|
+
The narrowing is convenience, not the boundary: the server authorizes the pair
|
|
159
|
+
against the ISSUER's `adminScope` (ADR-0090 D12) at issuance and rejects the
|
|
160
|
+
whole invitation when it is out of scope. Accordingly the section is **hidden**
|
|
161
|
+
whenever the caller has no delegable authority, or the deployment exposes no
|
|
162
|
+
delegated-administration runtime at all (the endpoint answers 501 ⇒ `null`) —
|
|
163
|
+
never a form the server would refuse. An ordinary invitation is unchanged: with
|
|
164
|
+
no placement chosen, the request body is byte-identical to before.
|
|
165
|
+
|
|
166
|
+
### Patch Changes
|
|
167
|
+
|
|
168
|
+
- 503d3f6: docs(auth): the org-role vocabulary is closed — correct the mirror's standing instruction (framework ADR-0108)
|
|
169
|
+
|
|
170
|
+
`org-roles.ts` carried a standing instruction that is now wrong: _"a role added
|
|
171
|
+
server-side must be added HERE too."_ There are no server-side additions left
|
|
172
|
+
to chase.
|
|
173
|
+
|
|
174
|
+
The framework used to register every declared `position` / `permission` name as
|
|
175
|
+
an organization role, so the console's list could always fall behind the
|
|
176
|
+
server's. That channel was retired (framework ADR-0108, objectstack#3723):
|
|
177
|
+
every value stored in `sys_member.role` is projected into
|
|
178
|
+
`current_user.positions`, so a business role handed out that way was capability
|
|
179
|
+
with none of the position system's controls — no `granted_by`, no validity
|
|
180
|
+
window, no scope check. `sys_member.role` is now a closed, framework-owned list
|
|
181
|
+
of `owner` / `admin` / `delegated_admin` / `member`, and an app's own business
|
|
182
|
+
roles are positions, granted through `sys_user_position` or an invitation's
|
|
183
|
+
placement (framework ADR-0105 D8).
|
|
184
|
+
|
|
185
|
+
So this mirror is now complete **by construction** rather than by vigilance.
|
|
186
|
+
Nothing about the console's behaviour changes — the four names and their labels
|
|
187
|
+
are what they already were.
|
|
188
|
+
|
|
189
|
+
Still a mirror rather than a derivation, but only for a packaging reason now:
|
|
190
|
+
the names live in `@objectstack/spec` as `BUILTIN_MEMBERSHIP_ROLES` /
|
|
191
|
+
`BUILTIN_MEMBERSHIP_ROLE_OPTIONS`, which `@object-ui/auth` cannot import yet —
|
|
192
|
+
this package takes no dependency on `@objectstack/spec`, and those constants
|
|
193
|
+
ship in the first release carrying ADR-0108 (they are absent from the published
|
|
194
|
+
16.1.0). A new test pins the list to exactly those four in display order until
|
|
195
|
+
then, so drift fails loudly instead of silently offering a value the server's
|
|
196
|
+
enforced `select` would reject.
|
|
197
|
+
|
|
198
|
+
- Updated dependencies [1767124]
|
|
199
|
+
- Updated dependencies [8ecf5a6]
|
|
200
|
+
- Updated dependencies [dfd3705]
|
|
201
|
+
- Updated dependencies [6dee2cb]
|
|
202
|
+
- Updated dependencies [c7cff19]
|
|
203
|
+
- Updated dependencies [cd09a7b]
|
|
204
|
+
- Updated dependencies [f1abf0e]
|
|
205
|
+
- Updated dependencies [f05b84e]
|
|
206
|
+
- Updated dependencies [662bdf9]
|
|
207
|
+
- Updated dependencies [059a052]
|
|
208
|
+
- Updated dependencies [53642d4]
|
|
209
|
+
- Updated dependencies [8aae006]
|
|
210
|
+
- Updated dependencies [d147a13]
|
|
211
|
+
- @object-ui/types@17.0.0
|
|
212
|
+
|
|
3
213
|
## 16.1.0
|
|
4
214
|
|
|
5
215
|
### Minor Changes
|
package/dist/AuthContext.d.ts
CHANGED
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
* This source code is licensed under the MIT license found in the
|
|
6
6
|
* LICENSE file in the root directory of this source tree.
|
|
7
7
|
*/
|
|
8
|
-
import type { AuthUser, AuthSession, PreviewModeOptions, AuthOrganization, AuthOrganizationMember, AuthInvitation, AuthPublicConfig, SignInWithProviderOptions } from './types';
|
|
8
|
+
import type { AuthUser, AuthSession, PreviewModeOptions, AuthOrganization, AuthOrganizationMember, AuthInvitation, AuthPublicConfig, SignInWithProviderOptions, DelegableScope } from './types';
|
|
9
9
|
export interface AuthContextValue {
|
|
10
10
|
/** Current authenticated user */
|
|
11
11
|
user: AuthUser | null;
|
|
@@ -128,12 +128,24 @@ export interface AuthContextValue {
|
|
|
128
128
|
leaveOrganization: (orgId: string) => Promise<void>;
|
|
129
129
|
/** List members of an organization */
|
|
130
130
|
getMembers: (orgId: string) => Promise<AuthOrganizationMember[]>;
|
|
131
|
-
/**
|
|
131
|
+
/**
|
|
132
|
+
* Invite a user by email. `businessUnitId` / `positions` carry [framework
|
|
133
|
+
* ADR-0105 D8] placement intent, authorized server-side against the ISSUER's
|
|
134
|
+
* adminScope — an out-of-scope pair rejects the whole invitation.
|
|
135
|
+
*/
|
|
132
136
|
inviteMember: (data: {
|
|
133
137
|
organizationId: string;
|
|
134
138
|
email: string;
|
|
135
139
|
role: string;
|
|
140
|
+
businessUnitId?: string;
|
|
141
|
+
positions?: string[];
|
|
136
142
|
}) => Promise<AuthInvitation>;
|
|
143
|
+
/**
|
|
144
|
+
* [framework ADR-0090 D12 / ADR-0105 D8] What the caller may delegate:
|
|
145
|
+
* business units they may place into and positions they may assign. `null`
|
|
146
|
+
* when the deployment has no delegated-administration runtime.
|
|
147
|
+
*/
|
|
148
|
+
describeDelegableScope: () => Promise<DelegableScope | null>;
|
|
137
149
|
/** Remove a member by id */
|
|
138
150
|
removeMember: (data: {
|
|
139
151
|
organizationId: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthContext.d.ts","sourceRoot":"","sources":["../src/AuthContext.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,cAAc,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"AuthContext.d.ts","sourceRoot":"","sources":["../src/AuthContext.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,cAAc,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEhM,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,kCAAkC;IAClC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,2BAA2B;IAC3B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,iDAAiD;IACjD,aAAa,EAAE,OAAO,CAAC;IACvB,uEAAuE;IACvE,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,sCAAsC;IACtC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;kFAG8E;IAC9E,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,oBAAoB,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtG,gCAAgC;IAChC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,0BAA0B;IAC1B,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,6BAA6B;IAC7B,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,yEAAyE;IACzE,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,gCAAgC;IAChC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,uEAAuE;IACvE,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,yDAAyD;IACzD,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,+EAA+E;IAC/E,uBAAuB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,8EAA8E;IAC9E,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,4DAA4D;IAC5D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG;;;OAGG;IACH,cAAc,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H;;;;OAIG;IACH,mBAAmB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,2EAA2E;IAC3E,sBAAsB,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,KAAK,IAAI,CAAC;IACjF,gFAAgF;IAChF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtF,oEAAoE;IACpE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,sEAAsE;IACtE,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,gEAAgE;IAChE,aAAa,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/C,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAI/F,4CAA4C;IAC5C,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClC,oCAAoC;IACpC,kBAAkB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC5C,8HAA8H;IAC9H,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC5C,wCAAwC;IACxC,sBAAsB,EAAE,OAAO,CAAC;IAChC,iDAAiD;IACjD,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvG;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAAC;IACpE,gDAAgD;IAChD,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/I,qCAAqC;IACrC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,iDAAiD;IACjD,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAIpD,sCAAsC;IACtC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACjE;;;;OAIG;IACH,YAAY,EAAE,CAAC,IAAI,EAAE;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B;;;;OAIG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D,4BAA4B;IAC5B,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,6BAA6B;IAC7B,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAItG,mDAAmD;IACnD,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,2BAA2B;IAC3B,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,mCAAmC;IACnC,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,qDAAqD;IACrD,mBAAmB,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACtD;AAED,eAAO,MAAM,OAAO,kDAA+C,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAoD,MAAM,OAAO,CAAC;AAEzE,OAAO,KAAK,EAAwB,kBAAkB,EAAE,kBAAkB,EAAyG,MAAM,SAAS,CAAC;AAKnM,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,YAAY,CAAC,EAC3B,OAAO,EACP,MAAM,EAAE,cAAc,EACtB,iBAAiB,EACjB,OAAc,EACd,WAAW,EACX,QAAQ,GACT,EAAE,iBAAiB,
|
|
1
|
+
{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAoD,MAAM,OAAO,CAAC;AAEzE,OAAO,KAAK,EAAwB,kBAAkB,EAAE,kBAAkB,EAAyG,MAAM,SAAS,CAAC;AAKnM,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,YAAY,CAAC,EAC3B,OAAO,EACP,MAAM,EAAE,cAAc,EACtB,iBAAiB,EACjB,OAAc,EACd,WAAW,EACX,QAAQ,GACT,EAAE,iBAAiB,qBA6pBnB"}
|
package/dist/AuthProvider.js
CHANGED
|
@@ -494,6 +494,12 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
|
|
|
494
494
|
}, [client, activeOrganization, refreshOrganizations]);
|
|
495
495
|
const getMembers = useCallback((orgId) => client.getMembers(orgId), [client]);
|
|
496
496
|
const inviteMember = useCallback((data) => client.inviteMember(data), [client]);
|
|
497
|
+
/**
|
|
498
|
+
* [framework ADR-0090 D12 / ADR-0105 D8] What the caller may delegate — the
|
|
499
|
+
* narrowing input for the scoped-invitation placement pickers. `null` when
|
|
500
|
+
* the deployment doesn't expose it, so consumers hide placement entirely.
|
|
501
|
+
*/
|
|
502
|
+
const describeDelegableScope = useCallback(() => client.describeDelegableScope(), [client]);
|
|
497
503
|
const removeMember = useCallback((data) => client.removeMember(data), [client]);
|
|
498
504
|
const updateMemberRole = useCallback((data) => client.updateMemberRole(data), [client]);
|
|
499
505
|
const listInvitations = useCallback((orgId) => client.listInvitations(orgId), [client]);
|
|
@@ -551,6 +557,7 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
|
|
|
551
557
|
leaveOrganization,
|
|
552
558
|
getMembers,
|
|
553
559
|
inviteMember,
|
|
560
|
+
describeDelegableScope,
|
|
554
561
|
removeMember,
|
|
555
562
|
updateMemberRole,
|
|
556
563
|
listInvitations,
|
|
@@ -566,7 +573,7 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
|
|
|
566
573
|
remediationRequired, enrollTotp, verifyTotp,
|
|
567
574
|
organizations, activeOrganization, activeMember, isOrganizationsLoading, switchOrganization, createOrganization, refreshOrganizations,
|
|
568
575
|
updateOrganization, deleteOrganization, leaveOrganization,
|
|
569
|
-
getMembers, inviteMember, removeMember, updateMemberRole,
|
|
576
|
+
getMembers, inviteMember, describeDelegableScope, removeMember, updateMemberRole,
|
|
570
577
|
listInvitations, cancelInvitation, getInvitation, acceptInvitation, rejectInvitation, listUserInvitations,
|
|
571
578
|
]);
|
|
572
579
|
return _jsx(AuthCtx.Provider, { value: value, children: children });
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"createAuthClient.d.ts","sourceRoot":"","sources":["../src/createAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,UAAU,EAAE,gBAAgB,EAE7B,MAAM,SAAS,CAAC;AAIjB;;;GAGG;AACH,eAAO,MAAM,YAAY;kBACD,MAAM,GAAG,IAAI;WAE5B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aASf,IAAI;CAQd,CAAC;AAmHF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,
|
|
1
|
+
{"version":3,"file":"createAuthClient.d.ts","sourceRoot":"","sources":["../src/createAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,UAAU,EAAE,gBAAgB,EAE7B,MAAM,SAAS,CAAC;AAIjB;;;GAGG;AACH,eAAO,MAAM,YAAY;kBACD,MAAM,GAAG,IAAI;WAE5B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aASf,IAAI;CAQd,CAAC;AAmHF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAqrBrE"}
|
package/dist/createAuthClient.js
CHANGED
|
@@ -526,6 +526,36 @@ export function createAuthClient(config) {
|
|
|
526
526
|
const raw = data;
|
|
527
527
|
return (raw && typeof raw === 'object' && 'user' in raw ? raw.user : raw);
|
|
528
528
|
},
|
|
529
|
+
/**
|
|
530
|
+
* [framework ADR-0090 D12 / ADR-0105 D8] What the caller may delegate.
|
|
531
|
+
*
|
|
532
|
+
* Sits next to the auth base path (`…/auth` → `…/security/…`) rather than
|
|
533
|
+
* taking a second base URL, so a deployment that relocates its API prefix
|
|
534
|
+
* moves both together. Never throws: a deployment without the
|
|
535
|
+
* delegated-administration runtime answers 501, and any failure yields
|
|
536
|
+
* `null` so the caller HIDES placement instead of offering a form the
|
|
537
|
+
* server would refuse.
|
|
538
|
+
*/
|
|
539
|
+
async describeDelegableScope() {
|
|
540
|
+
try {
|
|
541
|
+
const securityBase = basePath.replace(/\/auth$/, '/security');
|
|
542
|
+
const response = await bearerFetch(`${origin}${securityBase}/my-delegable-scope`, {
|
|
543
|
+
method: 'GET',
|
|
544
|
+
headers: { 'Content-Type': 'application/json' },
|
|
545
|
+
});
|
|
546
|
+
if (!response.ok)
|
|
547
|
+
return null;
|
|
548
|
+
const body = (await response.json());
|
|
549
|
+
// The server wraps some payloads as `{ success, data }`; tolerate both.
|
|
550
|
+
const scope = body && typeof body === 'object' && 'data' in body ? body.data : body;
|
|
551
|
+
return scope && typeof scope === 'object' && Array.isArray(scope.placeableBusinessUnitIds)
|
|
552
|
+
? scope
|
|
553
|
+
: null;
|
|
554
|
+
}
|
|
555
|
+
catch {
|
|
556
|
+
return null;
|
|
557
|
+
}
|
|
558
|
+
},
|
|
529
559
|
async getConfig() {
|
|
530
560
|
if (!configPromise) {
|
|
531
561
|
configPromise = loadConfigWithRetry().catch((err) => {
|
|
@@ -658,6 +688,13 @@ export function createAuthClient(config) {
|
|
|
658
688
|
organizationId: inviteData.organizationId,
|
|
659
689
|
email: inviteData.email,
|
|
660
690
|
role: inviteData.role,
|
|
691
|
+
// [framework ADR-0105 D8] Placement intent rides better-auth's own
|
|
692
|
+
// `additionalFields` on the invitation. Omitted entirely when absent so
|
|
693
|
+
// an ordinary invite is byte-identical to before; when present, the
|
|
694
|
+
// server authorizes it against the ISSUER's adminScope and rejects the
|
|
695
|
+
// whole invitation if it is out of scope.
|
|
696
|
+
...(inviteData.businessUnitId ? { businessUnitId: inviteData.businessUnitId } : {}),
|
|
697
|
+
...(inviteData.positions?.length ? { positions: inviteData.positions } : {}),
|
|
661
698
|
});
|
|
662
699
|
if (error)
|
|
663
700
|
throw new Error(error.message ?? 'Failed to invite member');
|
package/dist/index.d.ts
CHANGED
|
@@ -34,7 +34,8 @@ export { createAuthClient, TokenStorage } from './createAuthClient';
|
|
|
34
34
|
export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier';
|
|
35
35
|
export { createAuthenticatedFetch, ActiveOrganizationStorage, type AuthenticatedAdapterOptions } from './createAuthenticatedFetch';
|
|
36
36
|
export { getUserInitials } from './types';
|
|
37
|
+
export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER, ORG_ROLES, ORG_ROLE_LABELS, orgRoleGrade, invitableOrgRoles, assignableOrgRoles, type OrgRole, } from './org-roles';
|
|
37
38
|
export { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthAlertIcon, AuthCheckIcon, AuthDivider, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles';
|
|
38
|
-
export type { AuthUser, AuthSession, AuthState, AuthClient, AuthClientConfig, AuthLinkComponentProps, AuthProviderConfig, PreviewModeOptions, SignInCredentials, SignUpData, AuthOrganization, AuthOrganizationMember, AuthInvitation, AuthSocialProvider, AuthPublicConfig, SignInWithProviderOptions, } from './types';
|
|
39
|
+
export type { AuthUser, AuthSession, AuthState, AuthClient, AuthClientConfig, AuthLinkComponentProps, AuthProviderConfig, PreviewModeOptions, SignInCredentials, SignUpData, AuthOrganization, AuthOrganizationMember, AuthInvitation, AuthSocialProvider, AuthPublicConfig, SignInWithProviderOptions, TenancyPosture, DelegableScope, } from './types';
|
|
39
40
|
export type { AuthContextValue } from './AuthContext';
|
|
40
41
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,KAAK,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACnI,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,KAAK,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACnI,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAO1C,OAAO,EACL,cAAc,EACd,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,OAAO,GACb,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,EACZ,WAAW,GACZ,MAAM,cAAc,CAAC;AAGtB,YAAY,EACV,QAAQ,EACR,WAAW,EACX,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,cAAc,EACd,cAAc,GACf,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -34,6 +34,12 @@ export { createAuthClient, TokenStorage } from './createAuthClient';
|
|
|
34
34
|
export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier';
|
|
35
35
|
export { createAuthenticatedFetch, ActiveOrganizationStorage } from './createAuthenticatedFetch';
|
|
36
36
|
export { getUserInitials } from './types';
|
|
37
|
+
// Organization membership-role vocabulary — a CLOSED, framework-owned list of
|
|
38
|
+
// four (framework ADR-0108), re-exported from `@objectstack/spec`'s
|
|
39
|
+
// `BUILTIN_MEMBERSHIP_ROLES` so it cannot drift — plus the labels and
|
|
40
|
+
// narrowing helpers every org screen shares, which stay console-owned
|
|
41
|
+
// (see `org-roles.ts` for the boundary).
|
|
42
|
+
export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER, ORG_ROLES, ORG_ROLE_LABELS, orgRoleGrade, invitableOrgRoles, assignableOrgRoles, } from './org-roles';
|
|
37
43
|
// Shared auth form primitives — exposed so consumers can build custom forms
|
|
38
44
|
// that match the look of LoginForm / RegisterForm / ForgotPasswordForm.
|
|
39
45
|
export { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthAlertIcon, AuthCheckIcon, AuthDivider, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles';
|
|
@@ -0,0 +1,93 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* ObjectUI
|
|
3
|
+
* Copyright (c) 2024-present ObjectStack Inc.
|
|
4
|
+
*
|
|
5
|
+
* This source code is licensed under the MIT license found in the
|
|
6
|
+
* LICENSE file in the root directory of this source tree.
|
|
7
|
+
*/
|
|
8
|
+
/**
|
|
9
|
+
* Organization membership roles — the console's ONE entry point for them.
|
|
10
|
+
*
|
|
11
|
+
* These are better-auth's organization roles as the ObjectStack framework
|
|
12
|
+
* registers them, stored in `sys_member.role` / `sys_invitation.role`. Before
|
|
13
|
+
* this module the vocabulary was inlined as `type Role = 'owner' | 'admin' |
|
|
14
|
+
* 'member'` in both `MembersPage` and `InviteMemberDialog`, so a role the
|
|
15
|
+
* server had learned about was still unreachable from either screen.
|
|
16
|
+
*
|
|
17
|
+
* ## The vocabulary is CLOSED — and derived, not mirrored
|
|
18
|
+
*
|
|
19
|
+
* [framework ADR-0108 / objectstack#3723] These four names are the WHOLE list,
|
|
20
|
+
* and the framework owns them. An application cannot add a fifth: the server
|
|
21
|
+
* used to register every declared `position` / `permission` name as an
|
|
22
|
+
* organization role, and that was retired, because every value stored in
|
|
23
|
+
* `sys_member.role` is projected into `current_user.positions` — so a business
|
|
24
|
+
* role handed out this way was capability with none of the position system's
|
|
25
|
+
* controls (no `granted_by`, no validity window, no scope check). A membership
|
|
26
|
+
* role is an organization GRADE (what you may reach); what a person may DO is
|
|
27
|
+
* a position, granted through `sys_user_position` or an invitation's placement
|
|
28
|
+
* (framework ADR-0105 D8).
|
|
29
|
+
*
|
|
30
|
+
* The names below are re-exports of `BUILTIN_MEMBERSHIP_ROLES` from
|
|
31
|
+
* `@objectstack/spec` — the same constant the enforced `sys_member.role` /
|
|
32
|
+
* `sys_invitation.role` selects are built from — so this list cannot drift
|
|
33
|
+
* from what the server accepts, by construction.
|
|
34
|
+
*
|
|
35
|
+
* What stays LOCAL, deliberately: `ORG_ROLE_LABELS` and the grade ladder
|
|
36
|
+
* (`orgRoleGrade` / `invitableOrgRoles` / `assignableOrgRoles`). They are
|
|
37
|
+
* console concerns — i18n keys and screen-narrowing rules — and folding them
|
|
38
|
+
* into the name list would be the modeling error ADR-0108 D4 warns about:
|
|
39
|
+
* *what names exist* is a list; *which names mean authority* and *how a name
|
|
40
|
+
* projects* are rules that belong next to what they govern.
|
|
41
|
+
*/
|
|
42
|
+
import { MEMBERSHIP_ROLE_OWNER as ORG_ROLE_OWNER, MEMBERSHIP_ROLE_ADMIN as ORG_ROLE_ADMIN, MEMBERSHIP_ROLE_DELEGATED_ADMIN as ORG_ROLE_DELEGATED_ADMIN, MEMBERSHIP_ROLE_MEMBER as ORG_ROLE_MEMBER, type BuiltinMembershipRole } from '@objectstack/spec';
|
|
43
|
+
export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER };
|
|
44
|
+
export type OrgRole = BuiltinMembershipRole;
|
|
45
|
+
/** Display order: most privileged first, as the spec ships it and the screens list it. */
|
|
46
|
+
export declare const ORG_ROLES: readonly OrgRole[];
|
|
47
|
+
/** i18n key + English fallback for a role, so every screen labels it identically. */
|
|
48
|
+
export declare const ORG_ROLE_LABELS: Record<OrgRole, {
|
|
49
|
+
key: string;
|
|
50
|
+
defaultValue: string;
|
|
51
|
+
}>;
|
|
52
|
+
/**
|
|
53
|
+
* Grade ladder, mirroring the framework's invitation role cap. Anything
|
|
54
|
+
* unrecognized — `member`, `delegated_admin`, an app-registered role — grades
|
|
55
|
+
* as an ordinary member; only better-auth's two administrative roles outrank
|
|
56
|
+
* it, because only they are auto-elevated to `organization_admin` server-side.
|
|
57
|
+
*
|
|
58
|
+
* An absent/unreadable role grades BELOW a plain member: the fail-closed floor,
|
|
59
|
+
* so an unverified caller is offered nothing privileged.
|
|
60
|
+
*/
|
|
61
|
+
export declare function orgRoleGrade(raw: unknown): number;
|
|
62
|
+
/**
|
|
63
|
+
* The roles `issuerRole` may confer through an INVITATION — mirroring the
|
|
64
|
+
* framework's `beforeCreateInvitation` role cap:
|
|
65
|
+
*
|
|
66
|
+
* - an invited role may never outrank the issuer's own;
|
|
67
|
+
* - an issuer below admin grade may invite as `member` only (an app-registered
|
|
68
|
+
* role projects into `current_user.positions` and may be bound to permission
|
|
69
|
+
* sets, so it is a capability channel too — a delegate's channel for
|
|
70
|
+
* capability is the invitation's *placement*, which the D12 gate allowlists).
|
|
71
|
+
*
|
|
72
|
+
* Same property as the placement picker: this NARROWS, it does not decide. The
|
|
73
|
+
* server re-checks and rejects out-of-cap invitations, so the console is free to
|
|
74
|
+
* be helpful without being load-bearing — and it fails toward *less*: an
|
|
75
|
+
* unresolvable issuer role offers `member` alone.
|
|
76
|
+
*/
|
|
77
|
+
export declare function invitableOrgRoles(issuerRole: unknown): OrgRole[];
|
|
78
|
+
/**
|
|
79
|
+
* The roles `actorRole` may SET on an existing member — a different gate from
|
|
80
|
+
* invitation, mirroring better-auth's `update-member-role` route rather than the
|
|
81
|
+
* framework's cap:
|
|
82
|
+
*
|
|
83
|
+
* - the route requires the `member: ["update"]` permission, which only
|
|
84
|
+
* `owner`/`admin` hold (`delegated_admin` is built from `memberAc`, so it has
|
|
85
|
+
* `member: []` and may not re-role anyone);
|
|
86
|
+
* - only an owner may SET `owner`, and only an owner may modify a member who
|
|
87
|
+
* already IS one (better-auth's `creatorRole` protection).
|
|
88
|
+
*
|
|
89
|
+
* Returns an empty list when the actor may not re-role at all, so the screen can
|
|
90
|
+
* omit the affordance instead of offering items that would 403.
|
|
91
|
+
*/
|
|
92
|
+
export declare function assignableOrgRoles(actorRole: unknown, targetRole?: unknown): OrgRole[];
|
|
93
|
+
//# sourceMappingURL=org-roles.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"org-roles.d.ts","sourceRoot":"","sources":["../src/org-roles.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAEL,qBAAqB,IAAI,cAAc,EACvC,qBAAqB,IAAI,cAAc,EACvC,+BAA+B,IAAI,wBAAwB,EAC3D,sBAAsB,IAAI,eAAe,EACzC,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,wBAAwB,EAAE,eAAe,EAAE,CAAC;AAErF,MAAM,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAE5C,0FAA0F;AAC1F,eAAO,MAAM,SAAS,EAAE,SAAS,OAAO,EAAkC,CAAC;AAE3E,qFAAqF;AACrF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlF,CAAC;AAOF;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAajD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,EAAE,CAIhE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAOtF"}
|
|
@@ -0,0 +1,137 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* ObjectUI
|
|
3
|
+
* Copyright (c) 2024-present ObjectStack Inc.
|
|
4
|
+
*
|
|
5
|
+
* This source code is licensed under the MIT license found in the
|
|
6
|
+
* LICENSE file in the root directory of this source tree.
|
|
7
|
+
*/
|
|
8
|
+
/**
|
|
9
|
+
* Organization membership roles — the console's ONE entry point for them.
|
|
10
|
+
*
|
|
11
|
+
* These are better-auth's organization roles as the ObjectStack framework
|
|
12
|
+
* registers them, stored in `sys_member.role` / `sys_invitation.role`. Before
|
|
13
|
+
* this module the vocabulary was inlined as `type Role = 'owner' | 'admin' |
|
|
14
|
+
* 'member'` in both `MembersPage` and `InviteMemberDialog`, so a role the
|
|
15
|
+
* server had learned about was still unreachable from either screen.
|
|
16
|
+
*
|
|
17
|
+
* ## The vocabulary is CLOSED — and derived, not mirrored
|
|
18
|
+
*
|
|
19
|
+
* [framework ADR-0108 / objectstack#3723] These four names are the WHOLE list,
|
|
20
|
+
* and the framework owns them. An application cannot add a fifth: the server
|
|
21
|
+
* used to register every declared `position` / `permission` name as an
|
|
22
|
+
* organization role, and that was retired, because every value stored in
|
|
23
|
+
* `sys_member.role` is projected into `current_user.positions` — so a business
|
|
24
|
+
* role handed out this way was capability with none of the position system's
|
|
25
|
+
* controls (no `granted_by`, no validity window, no scope check). A membership
|
|
26
|
+
* role is an organization GRADE (what you may reach); what a person may DO is
|
|
27
|
+
* a position, granted through `sys_user_position` or an invitation's placement
|
|
28
|
+
* (framework ADR-0105 D8).
|
|
29
|
+
*
|
|
30
|
+
* The names below are re-exports of `BUILTIN_MEMBERSHIP_ROLES` from
|
|
31
|
+
* `@objectstack/spec` — the same constant the enforced `sys_member.role` /
|
|
32
|
+
* `sys_invitation.role` selects are built from — so this list cannot drift
|
|
33
|
+
* from what the server accepts, by construction.
|
|
34
|
+
*
|
|
35
|
+
* What stays LOCAL, deliberately: `ORG_ROLE_LABELS` and the grade ladder
|
|
36
|
+
* (`orgRoleGrade` / `invitableOrgRoles` / `assignableOrgRoles`). They are
|
|
37
|
+
* console concerns — i18n keys and screen-narrowing rules — and folding them
|
|
38
|
+
* into the name list would be the modeling error ADR-0108 D4 warns about:
|
|
39
|
+
* *what names exist* is a list; *which names mean authority* and *how a name
|
|
40
|
+
* projects* are rules that belong next to what they govern.
|
|
41
|
+
*/
|
|
42
|
+
import { BUILTIN_MEMBERSHIP_ROLES, MEMBERSHIP_ROLE_OWNER as ORG_ROLE_OWNER, MEMBERSHIP_ROLE_ADMIN as ORG_ROLE_ADMIN, MEMBERSHIP_ROLE_DELEGATED_ADMIN as ORG_ROLE_DELEGATED_ADMIN, MEMBERSHIP_ROLE_MEMBER as ORG_ROLE_MEMBER, } from '@objectstack/spec';
|
|
43
|
+
// Kept under the console's own names so call sites read as org-screen
|
|
44
|
+
// vocabulary. `ORG_ROLE_DELEGATED_ADMIN` is ADR-0105 D8's delegated issuer
|
|
45
|
+
// grade: it may reach `/organization/invite-member` WITHOUT being an org
|
|
46
|
+
// admin, and carries no authority of its own — what a delegate may actually
|
|
47
|
+
// *place* comes from a separately-granted `adminScope`, surfaced to this
|
|
48
|
+
// console by `describeDelegableScope()`.
|
|
49
|
+
export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER };
|
|
50
|
+
/** Display order: most privileged first, as the spec ships it and the screens list it. */
|
|
51
|
+
export const ORG_ROLES = [...BUILTIN_MEMBERSHIP_ROLES];
|
|
52
|
+
/** i18n key + English fallback for a role, so every screen labels it identically. */
|
|
53
|
+
export const ORG_ROLE_LABELS = {
|
|
54
|
+
[ORG_ROLE_OWNER]: { key: 'organization.roles.owner', defaultValue: 'Owner' },
|
|
55
|
+
[ORG_ROLE_ADMIN]: { key: 'organization.roles.admin', defaultValue: 'Admin' },
|
|
56
|
+
[ORG_ROLE_DELEGATED_ADMIN]: {
|
|
57
|
+
key: 'organization.roles.delegatedAdmin',
|
|
58
|
+
defaultValue: 'Delegated Admin',
|
|
59
|
+
},
|
|
60
|
+
[ORG_ROLE_MEMBER]: { key: 'organization.roles.member', defaultValue: 'Member' },
|
|
61
|
+
};
|
|
62
|
+
const GRADE_UNRESOLVED = 0;
|
|
63
|
+
const GRADE_MEMBER = 1;
|
|
64
|
+
const GRADE_ADMIN = 2;
|
|
65
|
+
const GRADE_OWNER = 3;
|
|
66
|
+
/**
|
|
67
|
+
* Grade ladder, mirroring the framework's invitation role cap. Anything
|
|
68
|
+
* unrecognized — `member`, `delegated_admin`, an app-registered role — grades
|
|
69
|
+
* as an ordinary member; only better-auth's two administrative roles outrank
|
|
70
|
+
* it, because only they are auto-elevated to `organization_admin` server-side.
|
|
71
|
+
*
|
|
72
|
+
* An absent/unreadable role grades BELOW a plain member: the fail-closed floor,
|
|
73
|
+
* so an unverified caller is offered nothing privileged.
|
|
74
|
+
*/
|
|
75
|
+
export function orgRoleGrade(raw) {
|
|
76
|
+
if (typeof raw !== 'string')
|
|
77
|
+
return GRADE_UNRESOLVED;
|
|
78
|
+
const roles = raw
|
|
79
|
+
.split(',')
|
|
80
|
+
.map((r) => r.trim().toLowerCase())
|
|
81
|
+
.filter(Boolean);
|
|
82
|
+
if (roles.length === 0)
|
|
83
|
+
return GRADE_UNRESOLVED;
|
|
84
|
+
let grade = GRADE_MEMBER;
|
|
85
|
+
for (const role of roles) {
|
|
86
|
+
if (role === ORG_ROLE_OWNER)
|
|
87
|
+
grade = Math.max(grade, GRADE_OWNER);
|
|
88
|
+
else if (role === ORG_ROLE_ADMIN)
|
|
89
|
+
grade = Math.max(grade, GRADE_ADMIN);
|
|
90
|
+
}
|
|
91
|
+
return grade;
|
|
92
|
+
}
|
|
93
|
+
/**
|
|
94
|
+
* The roles `issuerRole` may confer through an INVITATION — mirroring the
|
|
95
|
+
* framework's `beforeCreateInvitation` role cap:
|
|
96
|
+
*
|
|
97
|
+
* - an invited role may never outrank the issuer's own;
|
|
98
|
+
* - an issuer below admin grade may invite as `member` only (an app-registered
|
|
99
|
+
* role projects into `current_user.positions` and may be bound to permission
|
|
100
|
+
* sets, so it is a capability channel too — a delegate's channel for
|
|
101
|
+
* capability is the invitation's *placement*, which the D12 gate allowlists).
|
|
102
|
+
*
|
|
103
|
+
* Same property as the placement picker: this NARROWS, it does not decide. The
|
|
104
|
+
* server re-checks and rejects out-of-cap invitations, so the console is free to
|
|
105
|
+
* be helpful without being load-bearing — and it fails toward *less*: an
|
|
106
|
+
* unresolvable issuer role offers `member` alone.
|
|
107
|
+
*/
|
|
108
|
+
export function invitableOrgRoles(issuerRole) {
|
|
109
|
+
const grade = orgRoleGrade(issuerRole);
|
|
110
|
+
if (grade < GRADE_ADMIN)
|
|
111
|
+
return [ORG_ROLE_MEMBER];
|
|
112
|
+
return ORG_ROLES.filter((r) => orgRoleGrade(r) <= grade);
|
|
113
|
+
}
|
|
114
|
+
/**
|
|
115
|
+
* The roles `actorRole` may SET on an existing member — a different gate from
|
|
116
|
+
* invitation, mirroring better-auth's `update-member-role` route rather than the
|
|
117
|
+
* framework's cap:
|
|
118
|
+
*
|
|
119
|
+
* - the route requires the `member: ["update"]` permission, which only
|
|
120
|
+
* `owner`/`admin` hold (`delegated_admin` is built from `memberAc`, so it has
|
|
121
|
+
* `member: []` and may not re-role anyone);
|
|
122
|
+
* - only an owner may SET `owner`, and only an owner may modify a member who
|
|
123
|
+
* already IS one (better-auth's `creatorRole` protection).
|
|
124
|
+
*
|
|
125
|
+
* Returns an empty list when the actor may not re-role at all, so the screen can
|
|
126
|
+
* omit the affordance instead of offering items that would 403.
|
|
127
|
+
*/
|
|
128
|
+
export function assignableOrgRoles(actorRole, targetRole) {
|
|
129
|
+
const actor = orgRoleGrade(actorRole);
|
|
130
|
+
if (actor < GRADE_ADMIN)
|
|
131
|
+
return [];
|
|
132
|
+
const actorIsOwner = actor >= GRADE_OWNER;
|
|
133
|
+
// An existing owner is owner-editable only.
|
|
134
|
+
if (!actorIsOwner && orgRoleGrade(targetRole) >= GRADE_OWNER)
|
|
135
|
+
return [];
|
|
136
|
+
return ORG_ROLES.filter((r) => (r === ORG_ROLE_OWNER ? actorIsOwner : true));
|
|
137
|
+
}
|
package/dist/types.d.ts
CHANGED
|
@@ -84,6 +84,43 @@ export interface AuthSocialProvider {
|
|
|
84
84
|
/** 'social' uses better-auth built-in providers, 'oidc' uses generic oauth2 */
|
|
85
85
|
type?: 'social' | 'oidc';
|
|
86
86
|
}
|
|
87
|
+
/**
|
|
88
|
+
* Deployment tenancy posture (framework ADR-0105 D1).
|
|
89
|
+
*
|
|
90
|
+
* - `single` — one organization, no wall.
|
|
91
|
+
* - `group` — one shared database, organization as membership boundary:
|
|
92
|
+
* reads span every organization the caller belongs to, writes land in the
|
|
93
|
+
* ACTIVE organization.
|
|
94
|
+
* - `isolated` — hard per-organization walls (the pre-ADR-0105 `multi`).
|
|
95
|
+
*/
|
|
96
|
+
export type TenancyPosture = 'single' | 'group' | 'isolated';
|
|
97
|
+
/**
|
|
98
|
+
* [framework ADR-0090 D12 / ADR-0105 D8] What the caller may delegate, as
|
|
99
|
+
* returned by `GET /api/v1/security/my-delegable-scope`.
|
|
100
|
+
*
|
|
101
|
+
* A picker NARROWS with this; the server-side gate still decides. Empty lists
|
|
102
|
+
* mean "no delegated authority" — render no placement rather than a permissive
|
|
103
|
+
* form the server would refuse.
|
|
104
|
+
*/
|
|
105
|
+
export interface DelegableScope {
|
|
106
|
+
/** Unconstrained caller (tenant-level admin); the lists then enumerate everything. */
|
|
107
|
+
isTenantAdmin: boolean;
|
|
108
|
+
/** Business units the caller may place people into. */
|
|
109
|
+
placeableBusinessUnitIds: string[];
|
|
110
|
+
/** Positions the caller may assign — every set they distribute is allowlisted. */
|
|
111
|
+
assignablePositions: string[];
|
|
112
|
+
/** The `adminScope`s those derive from, for attribution. */
|
|
113
|
+
scopes: Array<{
|
|
114
|
+
setName: string;
|
|
115
|
+
businessUnit: string;
|
|
116
|
+
includeSubtree: boolean;
|
|
117
|
+
manageAssignments: boolean;
|
|
118
|
+
manageBindings: boolean;
|
|
119
|
+
authorEnvironmentSets: boolean;
|
|
120
|
+
assignablePermissionSets: string[];
|
|
121
|
+
businessUnitIds: string[];
|
|
122
|
+
}>;
|
|
123
|
+
}
|
|
87
124
|
/** Public auth configuration returned by the server */
|
|
88
125
|
export interface AuthPublicConfig {
|
|
89
126
|
emailPassword?: {
|
|
@@ -150,6 +187,17 @@ export interface AuthPublicConfig {
|
|
|
150
187
|
* (framework#2874 / objectui#2513).
|
|
151
188
|
*/
|
|
152
189
|
deviceAuthorization?: boolean;
|
|
190
|
+
/**
|
|
191
|
+
* Which tenancy posture the deployment runs (framework ADR-0105 D1).
|
|
192
|
+
* Non-boolean by design: `multiOrgEnabled` stays the capability gate
|
|
193
|
+
* ("is an organization wall enforced at all?"), while this key only tells
|
|
194
|
+
* the console HOW to render organization context. Under `group` the org
|
|
195
|
+
* switcher picks the WRITE target and reads span every organization the
|
|
196
|
+
* member belongs to, so group-only affordances (write-context labeling,
|
|
197
|
+
* org attribution in list views) key off `tenancyPosture === 'group'`.
|
|
198
|
+
* Absent (older server / config not yet fetched) ⇒ no group affordances.
|
|
199
|
+
*/
|
|
200
|
+
tenancyPosture?: TenancyPosture;
|
|
153
201
|
};
|
|
154
202
|
}
|
|
155
203
|
/** Options when initiating a third-party sign-in */
|
|
@@ -222,6 +270,15 @@ export interface AuthClient {
|
|
|
222
270
|
updateUser: (data: Partial<AuthUser>) => Promise<AuthUser>;
|
|
223
271
|
/** Fetch the public auth configuration from the server (providers, features) */
|
|
224
272
|
getConfig: () => Promise<AuthPublicConfig>;
|
|
273
|
+
/**
|
|
274
|
+
* [framework ADR-0090 D12 / ADR-0105 D8] What the CALLER may delegate —
|
|
275
|
+
* `GET /api/v1/security/my-delegable-scope`. Used to narrow the
|
|
276
|
+
* scoped-invitation placement pickers to the units and positions the issuer
|
|
277
|
+
* can actually hand out. `null` when the deployment doesn't expose it (no
|
|
278
|
+
* delegated-administration runtime ⇒ 501, or the request failed) — consumers
|
|
279
|
+
* then hide placement rather than offering something that would be refused.
|
|
280
|
+
*/
|
|
281
|
+
describeDelegableScope: () => Promise<DelegableScope | null>;
|
|
225
282
|
/** Initiate sign-in with a third-party provider (Google, GitHub, OIDC, etc.) */
|
|
226
283
|
signInWithProvider: (providerId: string, options?: SignInWithProviderOptions) => Promise<void>;
|
|
227
284
|
/** List organizations the current user belongs to */
|
|
@@ -245,6 +302,14 @@ export interface AuthClient {
|
|
|
245
302
|
organizationId: string;
|
|
246
303
|
email: string;
|
|
247
304
|
role: string;
|
|
305
|
+
/**
|
|
306
|
+
* [framework ADR-0105 D8] Placement intent — the business unit the invitee
|
|
307
|
+
* lands in and the positions they are assigned on acceptance. Authorized
|
|
308
|
+
* SERVER-side against the ISSUER's `adminScope`: an out-of-scope pair
|
|
309
|
+
* rejects the whole invitation, so this is a request, never an authority.
|
|
310
|
+
*/
|
|
311
|
+
businessUnitId?: string;
|
|
312
|
+
positions?: string[];
|
|
248
313
|
}) => Promise<AuthInvitation>;
|
|
249
314
|
/** Remove a member from an organization */
|
|
250
315
|
removeMember: (data: {
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B;;GAEG;AAEH,qCAAqC;AACrC,MAAM,WAAW,QAAQ;IACvB,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gCAAgC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+BAA+B;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAWjG;AAED,0BAA0B;AAC1B,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,2BAA2B;AAC3B,MAAM,WAAW,SAAS;IACxB,iCAAiC;IACjC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,sBAAsB;IACtB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,2BAA2B;IAC3B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,0BAA0B;AAC1B,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,mBAAmB;AACnB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gCAAgC;AAChC,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC,CAAC;IACF,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB;;;;;WAKG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;;;;;;;;WASG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;WAIG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B;;;WAGG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;;;WAMG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;;WAOG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B;;GAEG;AAEH,qCAAqC;AACrC,MAAM,WAAW,QAAQ;IACvB,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gCAAgC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+BAA+B;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAWjG;AAED,0BAA0B;AAC1B,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,2BAA2B;AAC3B,MAAM,WAAW,SAAS;IACxB,iCAAiC;IACjC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,sBAAsB;IACtB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,2BAA2B;IAC3B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,0BAA0B;AAC1B,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,mBAAmB;AACnB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gCAAgC;AAChC,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,aAAa,EAAE,OAAO,CAAC;IACvB,uDAAuD;IACvD,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,kFAAkF;IAClF,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,4DAA4D;IAC5D,MAAM,EAAE,KAAK,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,OAAO,CAAC;QACxB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;QACxB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,wBAAwB,EAAE,MAAM,EAAE,CAAC;QACnC,eAAe,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC,CAAC;CACJ;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC,CAAC;IACF,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB;;;;;WAKG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;;;;;;;;WASG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;WAIG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B;;;WAGG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;;;WAMG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;;WAOG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;;WASG;QACH,cAAc,CAAC,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IAC9F,0FAA0F;IAC1F,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;QAAC,oBAAoB,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtH,eAAe;IACf,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,WAAW,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC3E,6BAA6B;IAC7B,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,yEAAyE;IACzE,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,gCAAgC;IAChC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,oFAAoF;IACpF,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,uEAAuE;IACvE,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IAC7G,uGAAuG;IACvG,uBAAuB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IACtH,8EAA8E;IAC9E,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,6DAA6D;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG,gGAAgG;IAChG,cAAc,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,gFAAgF;IAChF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtF,oEAAoE;IACpE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,0BAA0B;IAC1B,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3D,gFAAgF;IAChF,SAAS,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAI/F,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrD,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvG,0DAA0D;IAC1D,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC3E,8CAA8C;IAC9C,qBAAqB,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC9D,iFAAiF;IACjF,eAAe,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC9D,qCAAqC;IACrC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACjE,yCAAyC;IACzC,YAAY,EAAE,CAAC,IAAI,EAAE;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb;;;;;WAKG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B,2CAA2C;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,6BAA6B;IAC7B,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,kCAAkC;IAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/I,6BAA6B;IAC7B,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,iDAAiD;IACjD,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAIpD,iEAAiE;IACjE,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,yCAAyC;IACzC,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,uEAAuE;IACvE,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,qDAAqD;IACrD,mBAAmB,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC5C,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,sBAAsB;IACrC,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,0BAA0B;AAC1B,MAAM,WAAW,sBAAsB;IACrC,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kCAAkC;AAClC,MAAM,WAAW,kBAAkB;IACjC,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC/C,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
|
package/dist/useAuth.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../src/useAuth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAW,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE/D;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,IAAI,gBAAgB,
|
|
1
|
+
{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../src/useAuth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAW,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE/D;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,IAAI,gBAAgB,CA4D1C"}
|
package/dist/useAuth.js
CHANGED
|
@@ -53,6 +53,7 @@ export function useAuth() {
|
|
|
53
53
|
setInitialPassword: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
|
|
54
54
|
hasLocalPassword: async () => false,
|
|
55
55
|
getAuthConfig: async () => ({}),
|
|
56
|
+
describeDelegableScope: async () => null,
|
|
56
57
|
signInWithProvider: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
|
|
57
58
|
organizations: [],
|
|
58
59
|
activeOrganization: null,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@object-ui/auth",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "17.1.0",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"description": "Authentication system for Object UI with AuthProvider, useAuth hook, AuthGuard, and form components.",
|
|
@@ -30,12 +30,13 @@
|
|
|
30
30
|
"react": "^18.0.0 || ^19.0.0"
|
|
31
31
|
},
|
|
32
32
|
"dependencies": {
|
|
33
|
-
"
|
|
34
|
-
"
|
|
33
|
+
"@objectstack/spec": "^17.0.0-rc.0",
|
|
34
|
+
"better-auth": "^1.6.25",
|
|
35
|
+
"@object-ui/types": "17.1.0"
|
|
35
36
|
},
|
|
36
37
|
"devDependencies": {
|
|
37
38
|
"@types/react": "19.2.17",
|
|
38
|
-
"react": "19.2.
|
|
39
|
+
"react": "19.2.8",
|
|
39
40
|
"typescript": "^6.0.3",
|
|
40
41
|
"vitest": "^4.1.10"
|
|
41
42
|
},
|