@object-ui/auth 16.1.0 → 17.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +284 -0
- package/README.md +1 -1
- package/dist/AuthContext.d.ts +15 -3
- package/dist/AuthContext.d.ts.map +1 -1
- package/dist/AuthProvider.d.ts +2 -2
- package/dist/AuthProvider.d.ts.map +1 -1
- package/dist/AuthProvider.js +8 -1
- package/dist/createAuthClient.d.ts.map +1 -1
- package/dist/createAuthClient.js +37 -0
- package/dist/index.d.ts +2 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +6 -0
- package/dist/org-roles.d.ts +93 -0
- package/dist/org-roles.d.ts.map +1 -0
- package/dist/org-roles.js +137 -0
- package/dist/types.d.ts +99 -18
- package/dist/types.d.ts.map +1 -1
- package/dist/useAuth.d.ts.map +1 -1
- package/dist/useAuth.js +1 -0
- package/package.json +6 -5
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,289 @@
|
|
|
1
1
|
# @object-ui/auth
|
|
2
2
|
|
|
3
|
+
## 17.2.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- 09d30a4: Stop declaring 18 `@object-ui/auth` / `@object-ui/components` / `@object-ui/react`
|
|
8
|
+
symbols under names `@objectstack/spec` owns (objectui#3159, objectstack#4115
|
|
9
|
+
batch 5).
|
|
10
|
+
|
|
11
|
+
**Breaking for importers of all three packages** — six exported names changed,
|
|
12
|
+
because the spec exports the same name for a _different_ thing:
|
|
13
|
+
|
|
14
|
+
| package | was | now | what the spec's same-named export actually is |
|
|
15
|
+
| :----------- | :--------------------------- | :----------------------- | :----------------------------------------------------------------------------- |
|
|
16
|
+
| `auth` | `AuthSession` | `AuthClientSession` | the SERVER's session record (`{ id, userId, expiresAt: ISO string, token? }`) |
|
|
17
|
+
| `auth` | `AuthProviderConfig` | `AuthProviderOptions` | an OAuth/OIDC provider registration (`{ id, clientId, clientSecret, scope? }`) |
|
|
18
|
+
| `components` | `FilterCondition` | `FilterBuilderCondition` | the recursive ObjectQL predicate AST (`$and`/`$or`/`$not`) |
|
|
19
|
+
| `components` | `Field` | `FieldContainer` | an object FIELD's metadata and its builder namespace |
|
|
20
|
+
| `react` | `ConflictResolutionStrategy` | `ConflictResolution` | the metadata-MERGE policy (`error \| priority \| first-wins \| last-wins`) |
|
|
21
|
+
|
|
22
|
+
The `react` rename is the odd one out: the new name is the **spec's own** name
|
|
23
|
+
for the union that hook always used, so it is a re-export rather than a dialect.
|
|
24
|
+
|
|
25
|
+
Eleven more keep their names and are now **imported or derived from the spec**
|
|
26
|
+
instead of re-declared: `TenancyPosture`, `DelegableScope` (+`DelegableAdminScope`),
|
|
27
|
+
`AuthUser`, `ShareLinkPermission`, `ShareLinkAudience`, `ShareLink`, `SortItem`,
|
|
28
|
+
`OfflineStrategy`, `OfflineCacheConfig`, `OfflineSyncConfig`, `OfflineConfig`,
|
|
29
|
+
`NavigationConfig`.
|
|
30
|
+
|
|
31
|
+
**Three of the copies were losing information, not just duplicating it.**
|
|
32
|
+
|
|
33
|
+
- `AuthUser` never declared the spec's `positions` or `tenantId` — the
|
|
34
|
+
authorization inputs. Its `[key: string]: unknown` index signature meant the
|
|
35
|
+
omission was invisible at every call site _and_ to any structural comparison
|
|
36
|
+
(the objectstack#4075 mechanism). It now `extends` the spec principal, so the
|
|
37
|
+
display-only fields (`image`, `role`, `roles`, `emailVerified`) are the delta
|
|
38
|
+
and the spec's keys arrive on their own.
|
|
39
|
+
- `useNavigationOverlay`'s copy carried the note _"inline … to avoid importing
|
|
40
|
+
from `@object-ui/types` (which may not be a direct dependency of
|
|
41
|
+
`@object-ui/react`)"_. The vocabulary belongs to `@objectstack/spec`, which
|
|
42
|
+
**is** a direct dependency — the same expired "kept local to avoid a
|
|
43
|
+
dependency" comment objectui#3169 found in `@object-ui/app-shell`.
|
|
44
|
+
- `useOffline` and `usePerformance` both opened with _"Types aligned with
|
|
45
|
+
`@objectstack/spec` v2.0.7"_. The installed spec is 17.0.0-rc.1.
|
|
46
|
+
|
|
47
|
+
`ShareLink` derives from the spec row **minus `password_hash`** — omitted rather
|
|
48
|
+
than optional, because it is the credential itself and typing it in a browser
|
|
49
|
+
package is an invitation to render it. `password_protected` (the boolean the UI
|
|
50
|
+
needs in its place) is the one local addition.
|
|
51
|
+
|
|
52
|
+
The config types derive from each schema's **input** side, not `z.infer`.
|
|
53
|
+
`useOffline(config: OfflineConfig = {})` defaults to the empty object, which the
|
|
54
|
+
output type — every `.default()`ed key required — would reject outright.
|
|
55
|
+
|
|
56
|
+
`@objectstack/spec` moves from `devDependencies` to `dependencies` in
|
|
57
|
+
`@object-ui/components`: its public type surface now references the spec.
|
|
58
|
+
|
|
59
|
+
Scored `minor`, not `major`, per this repo's fixed-group rule — objectui's major
|
|
60
|
+
tracks `@objectstack`, so breaking changes of our own ship as minor with the
|
|
61
|
+
semantics spelled out above (see AGENTS.md §版本号策略). A `major` here would carry
|
|
62
|
+
all 39 packages of the fixed group to `18.0.0` and off objectstack's 17.x line.
|
|
63
|
+
|
|
64
|
+
### Patch Changes
|
|
65
|
+
|
|
66
|
+
- Updated dependencies [4ae0ac4]
|
|
67
|
+
- Updated dependencies [696e3c1]
|
|
68
|
+
- Updated dependencies [4bf612c]
|
|
69
|
+
- Updated dependencies [cb82705]
|
|
70
|
+
- Updated dependencies [f572849]
|
|
71
|
+
- Updated dependencies [444457c]
|
|
72
|
+
- Updated dependencies [022e4c3]
|
|
73
|
+
- Updated dependencies [009e25d]
|
|
74
|
+
- Updated dependencies [726b89c]
|
|
75
|
+
- @object-ui/types@17.2.0
|
|
76
|
+
|
|
77
|
+
## 17.1.0
|
|
78
|
+
|
|
79
|
+
### Patch Changes
|
|
80
|
+
|
|
81
|
+
- fc60ad3: refactor(auth): derive the org-role vocabulary from `@objectstack/spec` instead of mirroring it
|
|
82
|
+
|
|
83
|
+
`org-roles.ts` restated the four membership-role names that `@objectstack/spec`
|
|
84
|
+
owns as `BUILTIN_MEMBERSHIP_ROLES`. That was a mirror for packaging reasons
|
|
85
|
+
only: this package took no dependency on the spec, and no published spec
|
|
86
|
+
carried the constants. Both blockers are gone — `@objectstack/spec@17.0.0-rc.0`
|
|
87
|
+
ships ADR-0108's closed vocabulary and the workspace already pins
|
|
88
|
+
`^17.0.0-rc.0` — so the four `ORG_ROLE_*` constants are now re-exports,
|
|
89
|
+
`OrgRole` is `BuiltinMembershipRole`, and `ORG_ROLES` is
|
|
90
|
+
`[...BUILTIN_MEMBERSHIP_ROLES]`. The list cannot drift from what the server's
|
|
91
|
+
enforced `select` accepts, by construction.
|
|
92
|
+
|
|
93
|
+
Deliberately still local: `ORG_ROLE_LABELS` and the grade ladder
|
|
94
|
+
(`orgRoleGrade` / `invitableOrgRoles` / `assignableOrgRoles`). They are console
|
|
95
|
+
concerns — i18n keys and screen-narrowing rules — and folding them into the
|
|
96
|
+
name list would be the modeling error ADR-0108 D4 warns about: _what names
|
|
97
|
+
exist_ is a list; _which names mean authority_ and _how a name projects_ are
|
|
98
|
+
rules that belong next to what they govern.
|
|
99
|
+
|
|
100
|
+
The #2907 drift guard (`is EXACTLY the framework four`) is dropped — a derived
|
|
101
|
+
list cannot drift, and asserting a re-export against a literal is noise. No
|
|
102
|
+
behaviour changes: the four names, their display order, and their labels are
|
|
103
|
+
exactly what they already were.
|
|
104
|
+
|
|
105
|
+
- Updated dependencies [9e7349e]
|
|
106
|
+
- Updated dependencies [8864971]
|
|
107
|
+
- Updated dependencies [b41f401]
|
|
108
|
+
- Updated dependencies [19e9fa0]
|
|
109
|
+
- Updated dependencies [38ca8be]
|
|
110
|
+
- Updated dependencies [4952edf]
|
|
111
|
+
- Updated dependencies [7f0252e]
|
|
112
|
+
- Updated dependencies [7639a61]
|
|
113
|
+
- Updated dependencies [94e63ef]
|
|
114
|
+
- Updated dependencies [c4db402]
|
|
115
|
+
- Updated dependencies [5319bf1]
|
|
116
|
+
- Updated dependencies [49e5671]
|
|
117
|
+
- Updated dependencies [b5b97e2]
|
|
118
|
+
- Updated dependencies [f59f2c1]
|
|
119
|
+
- Updated dependencies [4874117]
|
|
120
|
+
- Updated dependencies [ce08d55]
|
|
121
|
+
- Updated dependencies [2374a49]
|
|
122
|
+
- Updated dependencies [ea7f477]
|
|
123
|
+
- Updated dependencies [7f23cd0]
|
|
124
|
+
- Updated dependencies [24e0e0a]
|
|
125
|
+
- Updated dependencies [3a6cf24]
|
|
126
|
+
- Updated dependencies [aa35561]
|
|
127
|
+
- Updated dependencies [03bd53b]
|
|
128
|
+
- Updated dependencies [3c1f321]
|
|
129
|
+
- Updated dependencies [a045a32]
|
|
130
|
+
- Updated dependencies [912496d]
|
|
131
|
+
- Updated dependencies [9867281]
|
|
132
|
+
- @object-ui/types@17.1.0
|
|
133
|
+
|
|
134
|
+
## 17.0.0
|
|
135
|
+
|
|
136
|
+
### Minor Changes
|
|
137
|
+
|
|
138
|
+
- 8b4bc94: feat(console): group tenancy posture affordances — org switcher as write
|
|
139
|
+
context + org attribution in read views (framework ADR-0105 Phase 1)
|
|
140
|
+
|
|
141
|
+
Under the new `group` tenancy posture the server widens reads to every
|
|
142
|
+
organization the member belongs to (`organization_id IN accessible_org_ids`)
|
|
143
|
+
while writes land in the ACTIVE organization — so the console's existing
|
|
144
|
+
"which org am I in = which org's data I see" presentation becomes wrong the
|
|
145
|
+
moment a deployment switches postures. The ADR requires these affordances to
|
|
146
|
+
land WITH Phase 1, not after.
|
|
147
|
+
|
|
148
|
+
- `@object-ui/auth`: `AuthPublicConfig.features.tenancyPosture`
|
|
149
|
+
(`'single' | 'group' | 'isolated'`, exported as `TenancyPosture`) mirrors
|
|
150
|
+
the server's public auth config key. It gates nothing — `multiOrgEnabled`
|
|
151
|
+
stays the capability flag; this only tells the console how to render org
|
|
152
|
+
context.
|
|
153
|
+
- `useTenancyPosture()` (app-shell): reads the posture from the cached auth
|
|
154
|
+
config fetch; `undefined` (older server, unrecognized value, fetch failure)
|
|
155
|
+
keeps every group affordance off, so non-group deployments render
|
|
156
|
+
pixel-identical to today.
|
|
157
|
+
- `WorkspaceSwitcher`: under `group` the dropdown labels the active org
|
|
158
|
+
"Working organization" and explains the split — new records are created
|
|
159
|
+
here, views show data from all your organizations.
|
|
160
|
+
- `RecordFormPage` (create mode): org-walled objects show a "Creates in
|
|
161
|
+
<active org>" badge naming the engine's write target (ADR-0105 D5 stamps
|
|
162
|
+
`organization_id` from the active org).
|
|
163
|
+
- Default list columns (`ObjectView`, `InterfaceListPage`, `ObjectDataPage`):
|
|
164
|
+
under `group`, org-walled objects get a TRAILING `organization_id`
|
|
165
|
+
attribution column so cross-org rows are attributable at a glance.
|
|
166
|
+
Render-time only — never persisted into saved view/page metadata, and
|
|
167
|
+
business fields still lead.
|
|
168
|
+
|
|
169
|
+
- 54886ca: feat(console): make the `delegated_admin` org role reachable, and narrow both role pickers to what the server will accept (framework#3697)
|
|
170
|
+
|
|
171
|
+
The framework registered a fourth organization role — `delegated_admin`, the
|
|
172
|
+
grade that may reach `/organization/invite-member` **without** being an org
|
|
173
|
+
admin, which is what finally gives ADR-0105 D8's scope-bounded issuance gate a
|
|
174
|
+
caller. objectui#2868 already shipped the placement half of that UX (units and
|
|
175
|
+
positions narrowed by `describeDelegableScope()`), but the console could not
|
|
176
|
+
select the role in the first place: `MembersPage` and `InviteMemberDialog` each
|
|
177
|
+
inlined `type Role = 'owner' | 'admin' | 'member'`, so the capability the
|
|
178
|
+
framework grew was unreachable from either screen.
|
|
179
|
+
|
|
180
|
+
**One vocabulary, not two.** The role names, labels and narrowing rules now live
|
|
181
|
+
in `@object-ui/auth`'s new `org-roles` module (`ORG_ROLES`, `ORG_ROLE_LABELS`,
|
|
182
|
+
`orgRoleGrade`, `invitableOrgRoles`, `assignableOrgRoles`) and both screens
|
|
183
|
+
consume it. Note this list still **mirrors** the server rather than deriving
|
|
184
|
+
from it — `/auth/config` publishes feature flags but no role vocabulary, so
|
|
185
|
+
there is no surface to read; objectstack-ai/objectstack#3723 tracks making one
|
|
186
|
+
list the source for all of them. Until then a server-side role addition means
|
|
187
|
+
one console edit instead of two.
|
|
188
|
+
|
|
189
|
+
**The pickers now narrow, the way the placement picker already does.** Both
|
|
190
|
+
mirror a _different_ server gate, and offering an option the server would refuse
|
|
191
|
+
is the failure they prevent:
|
|
192
|
+
|
|
193
|
+
- **Invite role** ← the framework's `beforeCreateInvitation` role cap: never
|
|
194
|
+
above the issuer's own grade, and an issuer below admin grade may invite as
|
|
195
|
+
`member` only. A `delegated_admin` who picked "Admin" would have been refused
|
|
196
|
+
with a 403; that option is simply no longer offered.
|
|
197
|
+
- **Change role** ← better-auth's `update-member-role` route: it requires the
|
|
198
|
+
`member:["update"]` permission (owner/admin only — `delegated_admin` is built
|
|
199
|
+
from `memberAc` and holds `member: []`), and only an owner may set `owner` or
|
|
200
|
+
re-role an existing owner. An actor who may re-role nobody now gets no items
|
|
201
|
+
instead of three that would 403.
|
|
202
|
+
|
|
203
|
+
Narrowing is convenience, not the boundary — the server re-checks every one of
|
|
204
|
+
these — and it fails toward _less_: an unresolved membership offers `member`
|
|
205
|
+
alone on invite, and nothing on re-role.
|
|
206
|
+
|
|
207
|
+
An ordinary invitation is unchanged: with the default role and no placement, the
|
|
208
|
+
request body is byte-identical to before.
|
|
209
|
+
|
|
210
|
+
Note for translators: `organization.roles.*` has never been defined in any
|
|
211
|
+
locale bundle — all four labels (owner/admin/member included) resolve through
|
|
212
|
+
their `defaultValue` English fallback. The new role follows the same pattern
|
|
213
|
+
rather than being the only localized one.
|
|
214
|
+
|
|
215
|
+
- b5609cb: feat(console): scoped-invitation placement — invite someone straight into a
|
|
216
|
+
business unit and positions (framework ADR-0105 D8)
|
|
217
|
+
|
|
218
|
+
An invitation may now carry PLACEMENT INTENT: the business unit the invitee
|
|
219
|
+
lands in and the positions they are assigned when they accept. A plant admin's
|
|
220
|
+
invitee arrives already in the right unit and role instead of waiting on a
|
|
221
|
+
platform admin to finish the job by hand.
|
|
222
|
+
|
|
223
|
+
- `@object-ui/auth`: `inviteMember` accepts optional `businessUnitId` /
|
|
224
|
+
`positions` (passed through better-auth's invitation `additionalFields`), and
|
|
225
|
+
a new `describeDelegableScope()` reads
|
|
226
|
+
`GET /api/v1/security/my-delegable-scope`.
|
|
227
|
+
- `InviteMemberDialog`: an optional "Placement" section listing **only** the
|
|
228
|
+
units the issuer may place into and the positions they may hand out.
|
|
229
|
+
Positions appear once a unit is chosen — an unanchored assignment is refused
|
|
230
|
+
by the server, so offering it first would mislead.
|
|
231
|
+
|
|
232
|
+
The narrowing is convenience, not the boundary: the server authorizes the pair
|
|
233
|
+
against the ISSUER's `adminScope` (ADR-0090 D12) at issuance and rejects the
|
|
234
|
+
whole invitation when it is out of scope. Accordingly the section is **hidden**
|
|
235
|
+
whenever the caller has no delegable authority, or the deployment exposes no
|
|
236
|
+
delegated-administration runtime at all (the endpoint answers 501 ⇒ `null`) —
|
|
237
|
+
never a form the server would refuse. An ordinary invitation is unchanged: with
|
|
238
|
+
no placement chosen, the request body is byte-identical to before.
|
|
239
|
+
|
|
240
|
+
### Patch Changes
|
|
241
|
+
|
|
242
|
+
- 503d3f6: docs(auth): the org-role vocabulary is closed — correct the mirror's standing instruction (framework ADR-0108)
|
|
243
|
+
|
|
244
|
+
`org-roles.ts` carried a standing instruction that is now wrong: _"a role added
|
|
245
|
+
server-side must be added HERE too."_ There are no server-side additions left
|
|
246
|
+
to chase.
|
|
247
|
+
|
|
248
|
+
The framework used to register every declared `position` / `permission` name as
|
|
249
|
+
an organization role, so the console's list could always fall behind the
|
|
250
|
+
server's. That channel was retired (framework ADR-0108, objectstack#3723):
|
|
251
|
+
every value stored in `sys_member.role` is projected into
|
|
252
|
+
`current_user.positions`, so a business role handed out that way was capability
|
|
253
|
+
with none of the position system's controls — no `granted_by`, no validity
|
|
254
|
+
window, no scope check. `sys_member.role` is now a closed, framework-owned list
|
|
255
|
+
of `owner` / `admin` / `delegated_admin` / `member`, and an app's own business
|
|
256
|
+
roles are positions, granted through `sys_user_position` or an invitation's
|
|
257
|
+
placement (framework ADR-0105 D8).
|
|
258
|
+
|
|
259
|
+
So this mirror is now complete **by construction** rather than by vigilance.
|
|
260
|
+
Nothing about the console's behaviour changes — the four names and their labels
|
|
261
|
+
are what they already were.
|
|
262
|
+
|
|
263
|
+
Still a mirror rather than a derivation, but only for a packaging reason now:
|
|
264
|
+
the names live in `@objectstack/spec` as `BUILTIN_MEMBERSHIP_ROLES` /
|
|
265
|
+
`BUILTIN_MEMBERSHIP_ROLE_OPTIONS`, which `@object-ui/auth` cannot import yet —
|
|
266
|
+
this package takes no dependency on `@objectstack/spec`, and those constants
|
|
267
|
+
ship in the first release carrying ADR-0108 (they are absent from the published
|
|
268
|
+
16.1.0). A new test pins the list to exactly those four in display order until
|
|
269
|
+
then, so drift fails loudly instead of silently offering a value the server's
|
|
270
|
+
enforced `select` would reject.
|
|
271
|
+
|
|
272
|
+
- Updated dependencies [1767124]
|
|
273
|
+
- Updated dependencies [8ecf5a6]
|
|
274
|
+
- Updated dependencies [dfd3705]
|
|
275
|
+
- Updated dependencies [6dee2cb]
|
|
276
|
+
- Updated dependencies [c7cff19]
|
|
277
|
+
- Updated dependencies [cd09a7b]
|
|
278
|
+
- Updated dependencies [f1abf0e]
|
|
279
|
+
- Updated dependencies [f05b84e]
|
|
280
|
+
- Updated dependencies [662bdf9]
|
|
281
|
+
- Updated dependencies [059a052]
|
|
282
|
+
- Updated dependencies [53642d4]
|
|
283
|
+
- Updated dependencies [8aae006]
|
|
284
|
+
- Updated dependencies [d147a13]
|
|
285
|
+
- @object-ui/types@17.0.0
|
|
286
|
+
|
|
3
287
|
## 16.1.0
|
|
4
288
|
|
|
5
289
|
### Minor Changes
|
package/README.md
CHANGED
|
@@ -87,7 +87,7 @@ const {
|
|
|
87
87
|
| Property | Type | Description |
|
|
88
88
|
| --- | --- | --- |
|
|
89
89
|
| `user` | `AuthUser \| null` | Current authenticated user |
|
|
90
|
-
| `session` | `
|
|
90
|
+
| `session` | `AuthClientSession \| null` | Current session information |
|
|
91
91
|
| `isAuthenticated` | `boolean` | Whether the user is authenticated |
|
|
92
92
|
| `isLoading` | `boolean` | Whether auth state is loading |
|
|
93
93
|
| `isPreviewMode` | `boolean` | Whether the app is running in preview mode |
|
package/dist/AuthContext.d.ts
CHANGED
|
@@ -5,12 +5,12 @@
|
|
|
5
5
|
* This source code is licensed under the MIT license found in the
|
|
6
6
|
* LICENSE file in the root directory of this source tree.
|
|
7
7
|
*/
|
|
8
|
-
import type { AuthUser,
|
|
8
|
+
import type { AuthUser, AuthClientSession, PreviewModeOptions, AuthOrganization, AuthOrganizationMember, AuthInvitation, AuthPublicConfig, SignInWithProviderOptions, DelegableScope } from './types';
|
|
9
9
|
export interface AuthContextValue {
|
|
10
10
|
/** Current authenticated user */
|
|
11
11
|
user: AuthUser | null;
|
|
12
12
|
/** Current session information */
|
|
13
|
-
session:
|
|
13
|
+
session: AuthClientSession | null;
|
|
14
14
|
/** Whether the user is authenticated */
|
|
15
15
|
isAuthenticated: boolean;
|
|
16
16
|
/**
|
|
@@ -128,12 +128,24 @@ export interface AuthContextValue {
|
|
|
128
128
|
leaveOrganization: (orgId: string) => Promise<void>;
|
|
129
129
|
/** List members of an organization */
|
|
130
130
|
getMembers: (orgId: string) => Promise<AuthOrganizationMember[]>;
|
|
131
|
-
/**
|
|
131
|
+
/**
|
|
132
|
+
* Invite a user by email. `businessUnitId` / `positions` carry [framework
|
|
133
|
+
* ADR-0105 D8] placement intent, authorized server-side against the ISSUER's
|
|
134
|
+
* adminScope — an out-of-scope pair rejects the whole invitation.
|
|
135
|
+
*/
|
|
132
136
|
inviteMember: (data: {
|
|
133
137
|
organizationId: string;
|
|
134
138
|
email: string;
|
|
135
139
|
role: string;
|
|
140
|
+
businessUnitId?: string;
|
|
141
|
+
positions?: string[];
|
|
136
142
|
}) => Promise<AuthInvitation>;
|
|
143
|
+
/**
|
|
144
|
+
* [framework ADR-0090 D12 / ADR-0105 D8] What the caller may delegate:
|
|
145
|
+
* business units they may place into and positions they may assign. `null`
|
|
146
|
+
* when the deployment has no delegated-administration runtime.
|
|
147
|
+
*/
|
|
148
|
+
describeDelegableScope: () => Promise<DelegableScope | null>;
|
|
137
149
|
/** Remove a member by id */
|
|
138
150
|
removeMember: (data: {
|
|
139
151
|
organizationId: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthContext.d.ts","sourceRoot":"","sources":["../src/AuthContext.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,
|
|
1
|
+
{"version":3,"file":"AuthContext.d.ts","sourceRoot":"","sources":["../src/AuthContext.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,cAAc,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEtM,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,kCAAkC;IAClC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,2BAA2B;IAC3B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,iDAAiD;IACjD,aAAa,EAAE,OAAO,CAAC;IACvB,uEAAuE;IACvE,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,sCAAsC;IACtC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;kFAG8E;IAC9E,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,oBAAoB,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtG,gCAAgC;IAChC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,0BAA0B;IAC1B,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,6BAA6B;IAC7B,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,yEAAyE;IACzE,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,gCAAgC;IAChC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,uEAAuE;IACvE,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,yDAAyD;IACzD,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,+EAA+E;IAC/E,uBAAuB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,8EAA8E;IAC9E,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,4DAA4D;IAC5D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG;;;OAGG;IACH,cAAc,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H;;;;OAIG;IACH,mBAAmB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,2EAA2E;IAC3E,sBAAsB,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,KAAK,IAAI,CAAC;IACjF,gFAAgF;IAChF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtF,oEAAoE;IACpE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,sEAAsE;IACtE,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,gEAAgE;IAChE,aAAa,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/C,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAI/F,4CAA4C;IAC5C,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClC,oCAAoC;IACpC,kBAAkB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC5C,8HAA8H;IAC9H,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC5C,wCAAwC;IACxC,sBAAsB,EAAE,OAAO,CAAC;IAChC,iDAAiD;IACjD,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvG;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAAC;IACpE,gDAAgD;IAChD,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/I,qCAAqC;IACrC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,iDAAiD;IACjD,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAIpD,sCAAsC;IACtC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACjE;;;;OAIG;IACH,YAAY,EAAE,CAAC,IAAI,EAAE;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B;;;;OAIG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D,4BAA4B;IAC5B,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,6BAA6B;IAC7B,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAItG,mDAAmD;IACnD,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,2BAA2B;IAC3B,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,mCAAmC;IACnC,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,qDAAqD;IACrD,mBAAmB,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACtD;AAED,eAAO,MAAM,OAAO,kDAA+C,CAAC"}
|
package/dist/AuthProvider.d.ts
CHANGED
|
@@ -6,8 +6,8 @@
|
|
|
6
6
|
* LICENSE file in the root directory of this source tree.
|
|
7
7
|
*/
|
|
8
8
|
import React from 'react';
|
|
9
|
-
import type {
|
|
10
|
-
export interface AuthProviderProps extends
|
|
9
|
+
import type { AuthProviderOptions, PreviewModeOptions } from './types';
|
|
10
|
+
export interface AuthProviderProps extends AuthProviderOptions {
|
|
11
11
|
children: React.ReactNode;
|
|
12
12
|
/**
|
|
13
13
|
* Whether authentication is enabled.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAoD,MAAM,OAAO,CAAC;AAEzE,OAAO,KAAK,EAAwB,
|
|
1
|
+
{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAoD,MAAM,OAAO,CAAC;AAEzE,OAAO,KAAK,EAAwB,mBAAmB,EAAE,kBAAkB,EAAyG,MAAM,SAAS,CAAC;AAKpM,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,YAAY,CAAC,EAC3B,OAAO,EACP,MAAM,EAAE,cAAc,EACtB,iBAAiB,EACjB,OAAc,EACd,WAAW,EACX,QAAQ,GACT,EAAE,iBAAiB,qBA6pBnB"}
|
package/dist/AuthProvider.js
CHANGED
|
@@ -494,6 +494,12 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
|
|
|
494
494
|
}, [client, activeOrganization, refreshOrganizations]);
|
|
495
495
|
const getMembers = useCallback((orgId) => client.getMembers(orgId), [client]);
|
|
496
496
|
const inviteMember = useCallback((data) => client.inviteMember(data), [client]);
|
|
497
|
+
/**
|
|
498
|
+
* [framework ADR-0090 D12 / ADR-0105 D8] What the caller may delegate — the
|
|
499
|
+
* narrowing input for the scoped-invitation placement pickers. `null` when
|
|
500
|
+
* the deployment doesn't expose it, so consumers hide placement entirely.
|
|
501
|
+
*/
|
|
502
|
+
const describeDelegableScope = useCallback(() => client.describeDelegableScope(), [client]);
|
|
497
503
|
const removeMember = useCallback((data) => client.removeMember(data), [client]);
|
|
498
504
|
const updateMemberRole = useCallback((data) => client.updateMemberRole(data), [client]);
|
|
499
505
|
const listInvitations = useCallback((orgId) => client.listInvitations(orgId), [client]);
|
|
@@ -551,6 +557,7 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
|
|
|
551
557
|
leaveOrganization,
|
|
552
558
|
getMembers,
|
|
553
559
|
inviteMember,
|
|
560
|
+
describeDelegableScope,
|
|
554
561
|
removeMember,
|
|
555
562
|
updateMemberRole,
|
|
556
563
|
listInvitations,
|
|
@@ -566,7 +573,7 @@ export function AuthProvider({ authUrl, client: externalClient, onAuthStateChang
|
|
|
566
573
|
remediationRequired, enrollTotp, verifyTotp,
|
|
567
574
|
organizations, activeOrganization, activeMember, isOrganizationsLoading, switchOrganization, createOrganization, refreshOrganizations,
|
|
568
575
|
updateOrganization, deleteOrganization, leaveOrganization,
|
|
569
|
-
getMembers, inviteMember, removeMember, updateMemberRole,
|
|
576
|
+
getMembers, inviteMember, describeDelegableScope, removeMember, updateMemberRole,
|
|
570
577
|
listInvitations, cancelInvitation, getInvitation, acceptInvitation, rejectInvitation, listUserInvitations,
|
|
571
578
|
]);
|
|
572
579
|
return _jsx(AuthCtx.Provider, { value: value, children: children });
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"createAuthClient.d.ts","sourceRoot":"","sources":["../src/createAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,UAAU,EAAE,gBAAgB,EAE7B,MAAM,SAAS,CAAC;AAIjB;;;GAGG;AACH,eAAO,MAAM,YAAY;kBACD,MAAM,GAAG,IAAI;WAE5B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aASf,IAAI;CAQd,CAAC;AAmHF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,
|
|
1
|
+
{"version":3,"file":"createAuthClient.d.ts","sourceRoot":"","sources":["../src/createAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,UAAU,EAAE,gBAAgB,EAE7B,MAAM,SAAS,CAAC;AAIjB;;;GAGG;AACH,eAAO,MAAM,YAAY;kBACD,MAAM,GAAG,IAAI;WAE5B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aASf,IAAI;CAQd,CAAC;AAmHF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAqrBrE"}
|
package/dist/createAuthClient.js
CHANGED
|
@@ -526,6 +526,36 @@ export function createAuthClient(config) {
|
|
|
526
526
|
const raw = data;
|
|
527
527
|
return (raw && typeof raw === 'object' && 'user' in raw ? raw.user : raw);
|
|
528
528
|
},
|
|
529
|
+
/**
|
|
530
|
+
* [framework ADR-0090 D12 / ADR-0105 D8] What the caller may delegate.
|
|
531
|
+
*
|
|
532
|
+
* Sits next to the auth base path (`…/auth` → `…/security/…`) rather than
|
|
533
|
+
* taking a second base URL, so a deployment that relocates its API prefix
|
|
534
|
+
* moves both together. Never throws: a deployment without the
|
|
535
|
+
* delegated-administration runtime answers 501, and any failure yields
|
|
536
|
+
* `null` so the caller HIDES placement instead of offering a form the
|
|
537
|
+
* server would refuse.
|
|
538
|
+
*/
|
|
539
|
+
async describeDelegableScope() {
|
|
540
|
+
try {
|
|
541
|
+
const securityBase = basePath.replace(/\/auth$/, '/security');
|
|
542
|
+
const response = await bearerFetch(`${origin}${securityBase}/my-delegable-scope`, {
|
|
543
|
+
method: 'GET',
|
|
544
|
+
headers: { 'Content-Type': 'application/json' },
|
|
545
|
+
});
|
|
546
|
+
if (!response.ok)
|
|
547
|
+
return null;
|
|
548
|
+
const body = (await response.json());
|
|
549
|
+
// The server wraps some payloads as `{ success, data }`; tolerate both.
|
|
550
|
+
const scope = body && typeof body === 'object' && 'data' in body ? body.data : body;
|
|
551
|
+
return scope && typeof scope === 'object' && Array.isArray(scope.placeableBusinessUnitIds)
|
|
552
|
+
? scope
|
|
553
|
+
: null;
|
|
554
|
+
}
|
|
555
|
+
catch {
|
|
556
|
+
return null;
|
|
557
|
+
}
|
|
558
|
+
},
|
|
529
559
|
async getConfig() {
|
|
530
560
|
if (!configPromise) {
|
|
531
561
|
configPromise = loadConfigWithRetry().catch((err) => {
|
|
@@ -658,6 +688,13 @@ export function createAuthClient(config) {
|
|
|
658
688
|
organizationId: inviteData.organizationId,
|
|
659
689
|
email: inviteData.email,
|
|
660
690
|
role: inviteData.role,
|
|
691
|
+
// [framework ADR-0105 D8] Placement intent rides better-auth's own
|
|
692
|
+
// `additionalFields` on the invitation. Omitted entirely when absent so
|
|
693
|
+
// an ordinary invite is byte-identical to before; when present, the
|
|
694
|
+
// server authorizes it against the ISSUER's adminScope and rejects the
|
|
695
|
+
// whole invitation if it is out of scope.
|
|
696
|
+
...(inviteData.businessUnitId ? { businessUnitId: inviteData.businessUnitId } : {}),
|
|
697
|
+
...(inviteData.positions?.length ? { positions: inviteData.positions } : {}),
|
|
661
698
|
});
|
|
662
699
|
if (error)
|
|
663
700
|
throw new Error(error.message ?? 'Failed to invite member');
|
package/dist/index.d.ts
CHANGED
|
@@ -34,7 +34,8 @@ export { createAuthClient, TokenStorage } from './createAuthClient';
|
|
|
34
34
|
export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier';
|
|
35
35
|
export { createAuthenticatedFetch, ActiveOrganizationStorage, type AuthenticatedAdapterOptions } from './createAuthenticatedFetch';
|
|
36
36
|
export { getUserInitials } from './types';
|
|
37
|
+
export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER, ORG_ROLES, ORG_ROLE_LABELS, orgRoleGrade, invitableOrgRoles, assignableOrgRoles, type OrgRole, } from './org-roles';
|
|
37
38
|
export { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthAlertIcon, AuthCheckIcon, AuthDivider, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles';
|
|
38
|
-
export type { AuthUser,
|
|
39
|
+
export type { AuthUser, AuthClientSession, AuthState, AuthClient, AuthClientConfig, AuthLinkComponentProps, AuthProviderOptions, PreviewModeOptions, SignInCredentials, SignUpData, AuthOrganization, AuthOrganizationMember, AuthInvitation, AuthSocialProvider, AuthPublicConfig, SignInWithProviderOptions, TenancyPosture, DelegableScope, } from './types';
|
|
39
40
|
export type { AuthContextValue } from './AuthContext';
|
|
40
41
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,KAAK,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACnI,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,KAAK,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACnI,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAO1C,OAAO,EACL,cAAc,EACd,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,OAAO,GACb,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,EACZ,WAAW,GACZ,MAAM,cAAc,CAAC;AAGtB,YAAY,EACV,QAAQ,EACR,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,cAAc,EACd,cAAc,GACf,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -34,6 +34,12 @@ export { createAuthClient, TokenStorage } from './createAuthClient';
|
|
|
34
34
|
export { normalizePhoneIdentifier, looksLikePhoneIdentifier } from './phone-identifier';
|
|
35
35
|
export { createAuthenticatedFetch, ActiveOrganizationStorage } from './createAuthenticatedFetch';
|
|
36
36
|
export { getUserInitials } from './types';
|
|
37
|
+
// Organization membership-role vocabulary — a CLOSED, framework-owned list of
|
|
38
|
+
// four (framework ADR-0108), re-exported from `@objectstack/spec`'s
|
|
39
|
+
// `BUILTIN_MEMBERSHIP_ROLES` so it cannot drift — plus the labels and
|
|
40
|
+
// narrowing helpers every org screen shares, which stay console-owned
|
|
41
|
+
// (see `org-roles.ts` for the boundary).
|
|
42
|
+
export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER, ORG_ROLES, ORG_ROLE_LABELS, orgRoleGrade, invitableOrgRoles, assignableOrgRoles, } from './org-roles';
|
|
37
43
|
// Shared auth form primitives — exposed so consumers can build custom forms
|
|
38
44
|
// that match the look of LoginForm / RegisterForm / ForgotPasswordForm.
|
|
39
45
|
export { AUTH_FIELD_LABEL_CLASS, AUTH_INPUT_CLASS, AUTH_LINK_CLASS, AUTH_PRIMARY_BUTTON_CLASS, AuthAlertIcon, AuthCheckIcon, AuthDivider, AuthErrorBanner, AuthFormHeader, AuthMailIcon, AuthSpinner, } from './authStyles';
|
|
@@ -0,0 +1,93 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* ObjectUI
|
|
3
|
+
* Copyright (c) 2024-present ObjectStack Inc.
|
|
4
|
+
*
|
|
5
|
+
* This source code is licensed under the MIT license found in the
|
|
6
|
+
* LICENSE file in the root directory of this source tree.
|
|
7
|
+
*/
|
|
8
|
+
/**
|
|
9
|
+
* Organization membership roles — the console's ONE entry point for them.
|
|
10
|
+
*
|
|
11
|
+
* These are better-auth's organization roles as the ObjectStack framework
|
|
12
|
+
* registers them, stored in `sys_member.role` / `sys_invitation.role`. Before
|
|
13
|
+
* this module the vocabulary was inlined as `type Role = 'owner' | 'admin' |
|
|
14
|
+
* 'member'` in both `MembersPage` and `InviteMemberDialog`, so a role the
|
|
15
|
+
* server had learned about was still unreachable from either screen.
|
|
16
|
+
*
|
|
17
|
+
* ## The vocabulary is CLOSED — and derived, not mirrored
|
|
18
|
+
*
|
|
19
|
+
* [framework ADR-0108 / objectstack#3723] These four names are the WHOLE list,
|
|
20
|
+
* and the framework owns them. An application cannot add a fifth: the server
|
|
21
|
+
* used to register every declared `position` / `permission` name as an
|
|
22
|
+
* organization role, and that was retired, because every value stored in
|
|
23
|
+
* `sys_member.role` is projected into `current_user.positions` — so a business
|
|
24
|
+
* role handed out this way was capability with none of the position system's
|
|
25
|
+
* controls (no `granted_by`, no validity window, no scope check). A membership
|
|
26
|
+
* role is an organization GRADE (what you may reach); what a person may DO is
|
|
27
|
+
* a position, granted through `sys_user_position` or an invitation's placement
|
|
28
|
+
* (framework ADR-0105 D8).
|
|
29
|
+
*
|
|
30
|
+
* The names below are re-exports of `BUILTIN_MEMBERSHIP_ROLES` from
|
|
31
|
+
* `@objectstack/spec` — the same constant the enforced `sys_member.role` /
|
|
32
|
+
* `sys_invitation.role` selects are built from — so this list cannot drift
|
|
33
|
+
* from what the server accepts, by construction.
|
|
34
|
+
*
|
|
35
|
+
* What stays LOCAL, deliberately: `ORG_ROLE_LABELS` and the grade ladder
|
|
36
|
+
* (`orgRoleGrade` / `invitableOrgRoles` / `assignableOrgRoles`). They are
|
|
37
|
+
* console concerns — i18n keys and screen-narrowing rules — and folding them
|
|
38
|
+
* into the name list would be the modeling error ADR-0108 D4 warns about:
|
|
39
|
+
* *what names exist* is a list; *which names mean authority* and *how a name
|
|
40
|
+
* projects* are rules that belong next to what they govern.
|
|
41
|
+
*/
|
|
42
|
+
import { MEMBERSHIP_ROLE_OWNER as ORG_ROLE_OWNER, MEMBERSHIP_ROLE_ADMIN as ORG_ROLE_ADMIN, MEMBERSHIP_ROLE_DELEGATED_ADMIN as ORG_ROLE_DELEGATED_ADMIN, MEMBERSHIP_ROLE_MEMBER as ORG_ROLE_MEMBER, type BuiltinMembershipRole } from '@objectstack/spec';
|
|
43
|
+
export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER };
|
|
44
|
+
export type OrgRole = BuiltinMembershipRole;
|
|
45
|
+
/** Display order: most privileged first, as the spec ships it and the screens list it. */
|
|
46
|
+
export declare const ORG_ROLES: readonly OrgRole[];
|
|
47
|
+
/** i18n key + English fallback for a role, so every screen labels it identically. */
|
|
48
|
+
export declare const ORG_ROLE_LABELS: Record<OrgRole, {
|
|
49
|
+
key: string;
|
|
50
|
+
defaultValue: string;
|
|
51
|
+
}>;
|
|
52
|
+
/**
|
|
53
|
+
* Grade ladder, mirroring the framework's invitation role cap. Anything
|
|
54
|
+
* unrecognized — `member`, `delegated_admin`, an app-registered role — grades
|
|
55
|
+
* as an ordinary member; only better-auth's two administrative roles outrank
|
|
56
|
+
* it, because only they are auto-elevated to `organization_admin` server-side.
|
|
57
|
+
*
|
|
58
|
+
* An absent/unreadable role grades BELOW a plain member: the fail-closed floor,
|
|
59
|
+
* so an unverified caller is offered nothing privileged.
|
|
60
|
+
*/
|
|
61
|
+
export declare function orgRoleGrade(raw: unknown): number;
|
|
62
|
+
/**
|
|
63
|
+
* The roles `issuerRole` may confer through an INVITATION — mirroring the
|
|
64
|
+
* framework's `beforeCreateInvitation` role cap:
|
|
65
|
+
*
|
|
66
|
+
* - an invited role may never outrank the issuer's own;
|
|
67
|
+
* - an issuer below admin grade may invite as `member` only (an app-registered
|
|
68
|
+
* role projects into `current_user.positions` and may be bound to permission
|
|
69
|
+
* sets, so it is a capability channel too — a delegate's channel for
|
|
70
|
+
* capability is the invitation's *placement*, which the D12 gate allowlists).
|
|
71
|
+
*
|
|
72
|
+
* Same property as the placement picker: this NARROWS, it does not decide. The
|
|
73
|
+
* server re-checks and rejects out-of-cap invitations, so the console is free to
|
|
74
|
+
* be helpful without being load-bearing — and it fails toward *less*: an
|
|
75
|
+
* unresolvable issuer role offers `member` alone.
|
|
76
|
+
*/
|
|
77
|
+
export declare function invitableOrgRoles(issuerRole: unknown): OrgRole[];
|
|
78
|
+
/**
|
|
79
|
+
* The roles `actorRole` may SET on an existing member — a different gate from
|
|
80
|
+
* invitation, mirroring better-auth's `update-member-role` route rather than the
|
|
81
|
+
* framework's cap:
|
|
82
|
+
*
|
|
83
|
+
* - the route requires the `member: ["update"]` permission, which only
|
|
84
|
+
* `owner`/`admin` hold (`delegated_admin` is built from `memberAc`, so it has
|
|
85
|
+
* `member: []` and may not re-role anyone);
|
|
86
|
+
* - only an owner may SET `owner`, and only an owner may modify a member who
|
|
87
|
+
* already IS one (better-auth's `creatorRole` protection).
|
|
88
|
+
*
|
|
89
|
+
* Returns an empty list when the actor may not re-role at all, so the screen can
|
|
90
|
+
* omit the affordance instead of offering items that would 403.
|
|
91
|
+
*/
|
|
92
|
+
export declare function assignableOrgRoles(actorRole: unknown, targetRole?: unknown): OrgRole[];
|
|
93
|
+
//# sourceMappingURL=org-roles.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"org-roles.d.ts","sourceRoot":"","sources":["../src/org-roles.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAEL,qBAAqB,IAAI,cAAc,EACvC,qBAAqB,IAAI,cAAc,EACvC,+BAA+B,IAAI,wBAAwB,EAC3D,sBAAsB,IAAI,eAAe,EACzC,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,wBAAwB,EAAE,eAAe,EAAE,CAAC;AAErF,MAAM,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAE5C,0FAA0F;AAC1F,eAAO,MAAM,SAAS,EAAE,SAAS,OAAO,EAAkC,CAAC;AAE3E,qFAAqF;AACrF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlF,CAAC;AAOF;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAajD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,EAAE,CAIhE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAOtF"}
|
|
@@ -0,0 +1,137 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* ObjectUI
|
|
3
|
+
* Copyright (c) 2024-present ObjectStack Inc.
|
|
4
|
+
*
|
|
5
|
+
* This source code is licensed under the MIT license found in the
|
|
6
|
+
* LICENSE file in the root directory of this source tree.
|
|
7
|
+
*/
|
|
8
|
+
/**
|
|
9
|
+
* Organization membership roles — the console's ONE entry point for them.
|
|
10
|
+
*
|
|
11
|
+
* These are better-auth's organization roles as the ObjectStack framework
|
|
12
|
+
* registers them, stored in `sys_member.role` / `sys_invitation.role`. Before
|
|
13
|
+
* this module the vocabulary was inlined as `type Role = 'owner' | 'admin' |
|
|
14
|
+
* 'member'` in both `MembersPage` and `InviteMemberDialog`, so a role the
|
|
15
|
+
* server had learned about was still unreachable from either screen.
|
|
16
|
+
*
|
|
17
|
+
* ## The vocabulary is CLOSED — and derived, not mirrored
|
|
18
|
+
*
|
|
19
|
+
* [framework ADR-0108 / objectstack#3723] These four names are the WHOLE list,
|
|
20
|
+
* and the framework owns them. An application cannot add a fifth: the server
|
|
21
|
+
* used to register every declared `position` / `permission` name as an
|
|
22
|
+
* organization role, and that was retired, because every value stored in
|
|
23
|
+
* `sys_member.role` is projected into `current_user.positions` — so a business
|
|
24
|
+
* role handed out this way was capability with none of the position system's
|
|
25
|
+
* controls (no `granted_by`, no validity window, no scope check). A membership
|
|
26
|
+
* role is an organization GRADE (what you may reach); what a person may DO is
|
|
27
|
+
* a position, granted through `sys_user_position` or an invitation's placement
|
|
28
|
+
* (framework ADR-0105 D8).
|
|
29
|
+
*
|
|
30
|
+
* The names below are re-exports of `BUILTIN_MEMBERSHIP_ROLES` from
|
|
31
|
+
* `@objectstack/spec` — the same constant the enforced `sys_member.role` /
|
|
32
|
+
* `sys_invitation.role` selects are built from — so this list cannot drift
|
|
33
|
+
* from what the server accepts, by construction.
|
|
34
|
+
*
|
|
35
|
+
* What stays LOCAL, deliberately: `ORG_ROLE_LABELS` and the grade ladder
|
|
36
|
+
* (`orgRoleGrade` / `invitableOrgRoles` / `assignableOrgRoles`). They are
|
|
37
|
+
* console concerns — i18n keys and screen-narrowing rules — and folding them
|
|
38
|
+
* into the name list would be the modeling error ADR-0108 D4 warns about:
|
|
39
|
+
* *what names exist* is a list; *which names mean authority* and *how a name
|
|
40
|
+
* projects* are rules that belong next to what they govern.
|
|
41
|
+
*/
|
|
42
|
+
import { BUILTIN_MEMBERSHIP_ROLES, MEMBERSHIP_ROLE_OWNER as ORG_ROLE_OWNER, MEMBERSHIP_ROLE_ADMIN as ORG_ROLE_ADMIN, MEMBERSHIP_ROLE_DELEGATED_ADMIN as ORG_ROLE_DELEGATED_ADMIN, MEMBERSHIP_ROLE_MEMBER as ORG_ROLE_MEMBER, } from '@objectstack/spec';
|
|
43
|
+
// Kept under the console's own names so call sites read as org-screen
|
|
44
|
+
// vocabulary. `ORG_ROLE_DELEGATED_ADMIN` is ADR-0105 D8's delegated issuer
|
|
45
|
+
// grade: it may reach `/organization/invite-member` WITHOUT being an org
|
|
46
|
+
// admin, and carries no authority of its own — what a delegate may actually
|
|
47
|
+
// *place* comes from a separately-granted `adminScope`, surfaced to this
|
|
48
|
+
// console by `describeDelegableScope()`.
|
|
49
|
+
export { ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_DELEGATED_ADMIN, ORG_ROLE_MEMBER };
|
|
50
|
+
/** Display order: most privileged first, as the spec ships it and the screens list it. */
|
|
51
|
+
export const ORG_ROLES = [...BUILTIN_MEMBERSHIP_ROLES];
|
|
52
|
+
/** i18n key + English fallback for a role, so every screen labels it identically. */
|
|
53
|
+
export const ORG_ROLE_LABELS = {
|
|
54
|
+
[ORG_ROLE_OWNER]: { key: 'organization.roles.owner', defaultValue: 'Owner' },
|
|
55
|
+
[ORG_ROLE_ADMIN]: { key: 'organization.roles.admin', defaultValue: 'Admin' },
|
|
56
|
+
[ORG_ROLE_DELEGATED_ADMIN]: {
|
|
57
|
+
key: 'organization.roles.delegatedAdmin',
|
|
58
|
+
defaultValue: 'Delegated Admin',
|
|
59
|
+
},
|
|
60
|
+
[ORG_ROLE_MEMBER]: { key: 'organization.roles.member', defaultValue: 'Member' },
|
|
61
|
+
};
|
|
62
|
+
const GRADE_UNRESOLVED = 0;
|
|
63
|
+
const GRADE_MEMBER = 1;
|
|
64
|
+
const GRADE_ADMIN = 2;
|
|
65
|
+
const GRADE_OWNER = 3;
|
|
66
|
+
/**
|
|
67
|
+
* Grade ladder, mirroring the framework's invitation role cap. Anything
|
|
68
|
+
* unrecognized — `member`, `delegated_admin`, an app-registered role — grades
|
|
69
|
+
* as an ordinary member; only better-auth's two administrative roles outrank
|
|
70
|
+
* it, because only they are auto-elevated to `organization_admin` server-side.
|
|
71
|
+
*
|
|
72
|
+
* An absent/unreadable role grades BELOW a plain member: the fail-closed floor,
|
|
73
|
+
* so an unverified caller is offered nothing privileged.
|
|
74
|
+
*/
|
|
75
|
+
export function orgRoleGrade(raw) {
|
|
76
|
+
if (typeof raw !== 'string')
|
|
77
|
+
return GRADE_UNRESOLVED;
|
|
78
|
+
const roles = raw
|
|
79
|
+
.split(',')
|
|
80
|
+
.map((r) => r.trim().toLowerCase())
|
|
81
|
+
.filter(Boolean);
|
|
82
|
+
if (roles.length === 0)
|
|
83
|
+
return GRADE_UNRESOLVED;
|
|
84
|
+
let grade = GRADE_MEMBER;
|
|
85
|
+
for (const role of roles) {
|
|
86
|
+
if (role === ORG_ROLE_OWNER)
|
|
87
|
+
grade = Math.max(grade, GRADE_OWNER);
|
|
88
|
+
else if (role === ORG_ROLE_ADMIN)
|
|
89
|
+
grade = Math.max(grade, GRADE_ADMIN);
|
|
90
|
+
}
|
|
91
|
+
return grade;
|
|
92
|
+
}
|
|
93
|
+
/**
|
|
94
|
+
* The roles `issuerRole` may confer through an INVITATION — mirroring the
|
|
95
|
+
* framework's `beforeCreateInvitation` role cap:
|
|
96
|
+
*
|
|
97
|
+
* - an invited role may never outrank the issuer's own;
|
|
98
|
+
* - an issuer below admin grade may invite as `member` only (an app-registered
|
|
99
|
+
* role projects into `current_user.positions` and may be bound to permission
|
|
100
|
+
* sets, so it is a capability channel too — a delegate's channel for
|
|
101
|
+
* capability is the invitation's *placement*, which the D12 gate allowlists).
|
|
102
|
+
*
|
|
103
|
+
* Same property as the placement picker: this NARROWS, it does not decide. The
|
|
104
|
+
* server re-checks and rejects out-of-cap invitations, so the console is free to
|
|
105
|
+
* be helpful without being load-bearing — and it fails toward *less*: an
|
|
106
|
+
* unresolvable issuer role offers `member` alone.
|
|
107
|
+
*/
|
|
108
|
+
export function invitableOrgRoles(issuerRole) {
|
|
109
|
+
const grade = orgRoleGrade(issuerRole);
|
|
110
|
+
if (grade < GRADE_ADMIN)
|
|
111
|
+
return [ORG_ROLE_MEMBER];
|
|
112
|
+
return ORG_ROLES.filter((r) => orgRoleGrade(r) <= grade);
|
|
113
|
+
}
|
|
114
|
+
/**
|
|
115
|
+
* The roles `actorRole` may SET on an existing member — a different gate from
|
|
116
|
+
* invitation, mirroring better-auth's `update-member-role` route rather than the
|
|
117
|
+
* framework's cap:
|
|
118
|
+
*
|
|
119
|
+
* - the route requires the `member: ["update"]` permission, which only
|
|
120
|
+
* `owner`/`admin` hold (`delegated_admin` is built from `memberAc`, so it has
|
|
121
|
+
* `member: []` and may not re-role anyone);
|
|
122
|
+
* - only an owner may SET `owner`, and only an owner may modify a member who
|
|
123
|
+
* already IS one (better-auth's `creatorRole` protection).
|
|
124
|
+
*
|
|
125
|
+
* Returns an empty list when the actor may not re-role at all, so the screen can
|
|
126
|
+
* omit the affordance instead of offering items that would 403.
|
|
127
|
+
*/
|
|
128
|
+
export function assignableOrgRoles(actorRole, targetRole) {
|
|
129
|
+
const actor = orgRoleGrade(actorRole);
|
|
130
|
+
if (actor < GRADE_ADMIN)
|
|
131
|
+
return [];
|
|
132
|
+
const actorIsOwner = actor >= GRADE_OWNER;
|
|
133
|
+
// An existing owner is owner-editable only.
|
|
134
|
+
if (!actorIsOwner && orgRoleGrade(targetRole) >= GRADE_OWNER)
|
|
135
|
+
return [];
|
|
136
|
+
return ORG_ROLES.filter((r) => (r === ORG_ROLE_OWNER ? actorIsOwner : true));
|
|
137
|
+
}
|
package/dist/types.d.ts
CHANGED
|
@@ -6,17 +6,51 @@
|
|
|
6
6
|
* LICENSE file in the root directory of this source tree.
|
|
7
7
|
*/
|
|
8
8
|
import type React from 'react';
|
|
9
|
+
import type { AuthUser as SpecAuthUser, DelegableScope, DelegableAdminScope } from '@objectstack/spec/contracts';
|
|
10
|
+
import type { TenancyPosture } from '@objectstack/spec/security';
|
|
9
11
|
/**
|
|
10
12
|
* Authentication types for @object-ui/auth
|
|
11
13
|
*/
|
|
12
|
-
/**
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
14
|
+
/**
|
|
15
|
+
* The spec's tenancy posture vocabulary, verbatim (framework ADR-0105 D1).
|
|
16
|
+
*
|
|
17
|
+
* - `single` — one organization, no wall.
|
|
18
|
+
* - `group` — one shared database, organization as membership boundary:
|
|
19
|
+
* reads span every organization the caller belongs to, writes land in the
|
|
20
|
+
* ACTIVE organization.
|
|
21
|
+
* - `isolated` — hard per-organization walls (the pre-ADR-0105 `multi`).
|
|
22
|
+
*
|
|
23
|
+
* Was a hand-written union here until objectstack#4115 batch 5; it agreed with
|
|
24
|
+
* the spec member-for-member, which is exactly the state one spec release away
|
|
25
|
+
* from drifting.
|
|
26
|
+
*/
|
|
27
|
+
export type { TenancyPosture };
|
|
28
|
+
/**
|
|
29
|
+
* [framework ADR-0090 D12 / ADR-0105 D8] What the caller may delegate, as
|
|
30
|
+
* returned by `GET /api/v1/security/my-delegable-scope`.
|
|
31
|
+
*
|
|
32
|
+
* A picker NARROWS with this; the server-side gate still decides. Empty lists
|
|
33
|
+
* mean "no delegated authority" — render no placement rather than a permissive
|
|
34
|
+
* form the server would refuse.
|
|
35
|
+
*
|
|
36
|
+
* The spec owns the wire contract, so this is its binding rather than a copy
|
|
37
|
+
* (objectstack#4115). `DelegableAdminScope` comes along for the ride — the
|
|
38
|
+
* local copy had spelled that element type out inline.
|
|
39
|
+
*/
|
|
40
|
+
export type { DelegableScope, DelegableAdminScope };
|
|
41
|
+
/**
|
|
42
|
+
* Authenticated user information, as the BROWSER holds it.
|
|
43
|
+
*
|
|
44
|
+
* Derives from the spec's `AuthUser` (the `IAuthService` principal: `id`,
|
|
45
|
+
* `email`, `name`, plus the `positions` / `tenantId` an authorization decision
|
|
46
|
+
* needs) and adds the display-only fields better-auth returns to the client.
|
|
47
|
+
* Extending rather than re-declaring means a new spec field lands here the day
|
|
48
|
+
* the spec adds it, instead of silently going missing (objectstack#4115).
|
|
49
|
+
*
|
|
50
|
+
* The index signature is deliberate: better-auth projects an app's custom user
|
|
51
|
+
* columns onto this object and no local type can enumerate them.
|
|
52
|
+
*/
|
|
53
|
+
export interface AuthUser extends SpecAuthUser {
|
|
20
54
|
/** Profile image URL */
|
|
21
55
|
image?: string;
|
|
22
56
|
/** Primary role */
|
|
@@ -33,8 +67,18 @@ export interface AuthUser {
|
|
|
33
67
|
* Returns up to 2 uppercase characters.
|
|
34
68
|
*/
|
|
35
69
|
export declare function getUserInitials(user: Pick<AuthUser, 'name' | 'email'> | null | undefined): string;
|
|
36
|
-
/**
|
|
37
|
-
|
|
70
|
+
/**
|
|
71
|
+
* The credential bundle the BROWSER holds after a successful sign-in.
|
|
72
|
+
*
|
|
73
|
+
* Not the spec's `AuthSession` and deliberately not named after it
|
|
74
|
+
* (objectstack#4115): the spec models the SERVER's session record —
|
|
75
|
+
* `{ id, userId, expiresAt: ISO string, token? }`, keyed by a session id the
|
|
76
|
+
* client never sees — while this is the token set better-auth hands back:
|
|
77
|
+
* `token` is REQUIRED, `expiresAt` is a JS `Date`, and `refreshToken` has no
|
|
78
|
+
* spec counterpart at all. The two are mutually unassignable, so a re-export
|
|
79
|
+
* would have been a silent contract swap rather than a burn-down.
|
|
80
|
+
*/
|
|
81
|
+
export interface AuthClientSession {
|
|
38
82
|
/** Access token */
|
|
39
83
|
token: string;
|
|
40
84
|
/** Token expiry timestamp */
|
|
@@ -47,7 +91,7 @@ export interface AuthState {
|
|
|
47
91
|
/** Current authenticated user */
|
|
48
92
|
user: AuthUser | null;
|
|
49
93
|
/** Current session */
|
|
50
|
-
session:
|
|
94
|
+
session: AuthClientSession | null;
|
|
51
95
|
/** Whether the user is authenticated */
|
|
52
96
|
isAuthenticated: boolean;
|
|
53
97
|
/** Whether auth state is loading */
|
|
@@ -150,6 +194,17 @@ export interface AuthPublicConfig {
|
|
|
150
194
|
* (framework#2874 / objectui#2513).
|
|
151
195
|
*/
|
|
152
196
|
deviceAuthorization?: boolean;
|
|
197
|
+
/**
|
|
198
|
+
* Which tenancy posture the deployment runs (framework ADR-0105 D1).
|
|
199
|
+
* Non-boolean by design: `multiOrgEnabled` stays the capability gate
|
|
200
|
+
* ("is an organization wall enforced at all?"), while this key only tells
|
|
201
|
+
* the console HOW to render organization context. Under `group` the org
|
|
202
|
+
* switcher picks the WRITE target and reads span every organization the
|
|
203
|
+
* member belongs to, so group-only affordances (write-context labeling,
|
|
204
|
+
* org attribution in list views) key off `tenancyPosture === 'group'`.
|
|
205
|
+
* Absent (older server / config not yet fetched) ⇒ no group affordances.
|
|
206
|
+
*/
|
|
207
|
+
tenancyPosture?: TenancyPosture;
|
|
153
208
|
};
|
|
154
209
|
}
|
|
155
210
|
/** Options when initiating a third-party sign-in */
|
|
@@ -166,12 +221,12 @@ export interface AuthClient {
|
|
|
166
221
|
/** Sign in with email/password */
|
|
167
222
|
signIn: (credentials: SignInCredentials) => Promise<{
|
|
168
223
|
user: AuthUser;
|
|
169
|
-
session:
|
|
224
|
+
session: AuthClientSession;
|
|
170
225
|
}>;
|
|
171
226
|
/** Sign up with email/password. `session` is null when email verification is required. */
|
|
172
227
|
signUp: (data: SignUpData) => Promise<{
|
|
173
228
|
user: AuthUser;
|
|
174
|
-
session:
|
|
229
|
+
session: AuthClientSession | null;
|
|
175
230
|
requiresVerification: boolean;
|
|
176
231
|
}>;
|
|
177
232
|
/** Sign out */
|
|
@@ -179,7 +234,7 @@ export interface AuthClient {
|
|
|
179
234
|
/** Get current session */
|
|
180
235
|
getSession: () => Promise<{
|
|
181
236
|
user: AuthUser;
|
|
182
|
-
session:
|
|
237
|
+
session: AuthClientSession;
|
|
183
238
|
} | null>;
|
|
184
239
|
/** Reset password request */
|
|
185
240
|
forgotPassword: (email: string) => Promise<void>;
|
|
@@ -192,12 +247,12 @@ export interface AuthClient {
|
|
|
192
247
|
/** framework#2780 — verify a phone OTP; signs in the number's user. */
|
|
193
248
|
signInWithPhoneOtp: (phoneNumber: string, code: string) => Promise<{
|
|
194
249
|
user: AuthUser;
|
|
195
|
-
session:
|
|
250
|
+
session: AuthClientSession;
|
|
196
251
|
}>;
|
|
197
252
|
/** framework#2780 — sign in with phone number + password (no SMS; gated by `features.phoneNumber`). */
|
|
198
253
|
signInWithPhonePassword: (phoneNumber: string, password: string) => Promise<{
|
|
199
254
|
user: AuthUser;
|
|
200
|
-
session:
|
|
255
|
+
session: AuthClientSession;
|
|
201
256
|
}>;
|
|
202
257
|
/** framework#2780 — request a password-reset OTP SMS for the phone number. */
|
|
203
258
|
requestPhonePasswordReset: (phoneNumber: string) => Promise<void>;
|
|
@@ -222,6 +277,15 @@ export interface AuthClient {
|
|
|
222
277
|
updateUser: (data: Partial<AuthUser>) => Promise<AuthUser>;
|
|
223
278
|
/** Fetch the public auth configuration from the server (providers, features) */
|
|
224
279
|
getConfig: () => Promise<AuthPublicConfig>;
|
|
280
|
+
/**
|
|
281
|
+
* [framework ADR-0090 D12 / ADR-0105 D8] What the CALLER may delegate —
|
|
282
|
+
* `GET /api/v1/security/my-delegable-scope`. Used to narrow the
|
|
283
|
+
* scoped-invitation placement pickers to the units and positions the issuer
|
|
284
|
+
* can actually hand out. `null` when the deployment doesn't expose it (no
|
|
285
|
+
* delegated-administration runtime ⇒ 501, or the request failed) — consumers
|
|
286
|
+
* then hide placement rather than offering something that would be refused.
|
|
287
|
+
*/
|
|
288
|
+
describeDelegableScope: () => Promise<DelegableScope | null>;
|
|
225
289
|
/** Initiate sign-in with a third-party provider (Google, GitHub, OIDC, etc.) */
|
|
226
290
|
signInWithProvider: (providerId: string, options?: SignInWithProviderOptions) => Promise<void>;
|
|
227
291
|
/** List organizations the current user belongs to */
|
|
@@ -245,6 +309,14 @@ export interface AuthClient {
|
|
|
245
309
|
organizationId: string;
|
|
246
310
|
email: string;
|
|
247
311
|
role: string;
|
|
312
|
+
/**
|
|
313
|
+
* [framework ADR-0105 D8] Placement intent — the business unit the invitee
|
|
314
|
+
* lands in and the positions they are assigned on acceptance. Authorized
|
|
315
|
+
* SERVER-side against the ISSUER's `adminScope`: an out-of-scope pair
|
|
316
|
+
* rejects the whole invitation, so this is a request, never an authority.
|
|
317
|
+
*/
|
|
318
|
+
businessUnitId?: string;
|
|
319
|
+
positions?: string[];
|
|
248
320
|
}) => Promise<AuthInvitation>;
|
|
249
321
|
/** Remove a member from an organization */
|
|
250
322
|
removeMember: (data: {
|
|
@@ -360,8 +432,17 @@ export interface AuthOrganizationMember {
|
|
|
360
432
|
/** Creation timestamp */
|
|
361
433
|
createdAt?: string;
|
|
362
434
|
}
|
|
363
|
-
/**
|
|
364
|
-
|
|
435
|
+
/**
|
|
436
|
+
* Configuration for the React `<AuthProvider>` component.
|
|
437
|
+
*
|
|
438
|
+
* Deliberately NOT `AuthProviderConfig` (objectstack#4115): the spec owns that
|
|
439
|
+
* name for the OAuth/OIDC provider registration `{ id, clientId, clientSecret,
|
|
440
|
+
* scope? }` — same domain, same word "auth provider", completely different
|
|
441
|
+
* object. That is the collision most likely to be read as canonical by the next
|
|
442
|
+
* session, so this one carries a local name and a tripwire
|
|
443
|
+
* (`__tests__/auth-spec-parity.test.ts`).
|
|
444
|
+
*/
|
|
445
|
+
export interface AuthProviderOptions {
|
|
365
446
|
/** Authentication server URL */
|
|
366
447
|
authUrl: string;
|
|
367
448
|
/** Auth client instance (if already created) */
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,EACV,QAAQ,IAAI,YAAY,EACxB,cAAc,EACd,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;GAEG;AAEH;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;;;;;;;;;;;GAWG;AACH,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAS,SAAQ,YAAY;IAC5C,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gCAAgC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+BAA+B;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAWjG;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,2BAA2B;AAC3B,MAAM,WAAW,SAAS;IACxB,iCAAiC;IACjC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,sBAAsB;IACtB,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,2BAA2B;IAC3B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,0BAA0B;AAC1B,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,mBAAmB;AACnB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gCAAgC;AAChC,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC,CAAC;IACF,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB;;;;;WAKG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;;;;;;;;WASG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;WAIG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B;;;WAGG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;;;WAMG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;;WAOG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;;WASG;QACH,cAAc,CAAC,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACpG,0FAA0F;IAC1F,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;QAAC,oBAAoB,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5H,eAAe;IACf,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjF,6BAA6B;IAC7B,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,yEAAyE;IACzE,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,gCAAgC;IAChC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,oFAAoF;IACpF,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,uEAAuE;IACvE,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACnH,uGAAuG;IACvG,uBAAuB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IAC5H,8EAA8E;IAC9E,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,6DAA6D;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG,gGAAgG;IAChG,cAAc,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,gFAAgF;IAChF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtF,oEAAoE;IACpE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,0BAA0B;IAC1B,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3D,gFAAgF;IAChF,SAAS,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAI/F,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrD,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvG,0DAA0D;IAC1D,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC3E,8CAA8C;IAC9C,qBAAqB,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC9D,iFAAiF;IACjF,eAAe,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC9D,qCAAqC;IACrC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACjE,yCAAyC;IACzC,YAAY,EAAE,CAAC,IAAI,EAAE;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb;;;;;WAKG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B,2CAA2C;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,6BAA6B;IAC7B,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,kCAAkC;IAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/I,6BAA6B;IAC7B,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,iDAAiD;IACjD,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAIpD,iEAAiE;IACjE,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,yCAAyC;IACzC,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,uEAAuE;IACvE,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,qDAAqD;IACrD,mBAAmB,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC5C,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,sBAAsB;IACrC,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,0BAA0B;AAC1B,MAAM,WAAW,sBAAsB;IACrC,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC/C,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
|
package/dist/useAuth.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../src/useAuth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAW,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE/D;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,IAAI,gBAAgB,
|
|
1
|
+
{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../src/useAuth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAW,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE/D;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,IAAI,gBAAgB,CA4D1C"}
|
package/dist/useAuth.js
CHANGED
|
@@ -53,6 +53,7 @@ export function useAuth() {
|
|
|
53
53
|
setInitialPassword: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
|
|
54
54
|
hasLocalPassword: async () => false,
|
|
55
55
|
getAuthConfig: async () => ({}),
|
|
56
|
+
describeDelegableScope: async () => null,
|
|
56
57
|
signInWithProvider: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
|
|
57
58
|
organizations: [],
|
|
58
59
|
activeOrganization: null,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@object-ui/auth",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "17.2.0",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"description": "Authentication system for Object UI with AuthProvider, useAuth hook, AuthGuard, and form components.",
|
|
@@ -30,12 +30,13 @@
|
|
|
30
30
|
"react": "^18.0.0 || ^19.0.0"
|
|
31
31
|
},
|
|
32
32
|
"dependencies": {
|
|
33
|
-
"
|
|
34
|
-
"
|
|
33
|
+
"@objectstack/spec": "^17.0.0-rc.1",
|
|
34
|
+
"better-auth": "^1.6.25",
|
|
35
|
+
"@object-ui/types": "17.2.0"
|
|
35
36
|
},
|
|
36
37
|
"devDependencies": {
|
|
37
38
|
"@types/react": "19.2.17",
|
|
38
|
-
"react": "19.2.
|
|
39
|
+
"react": "19.2.8",
|
|
39
40
|
"typescript": "^6.0.3",
|
|
40
41
|
"vitest": "^4.1.10"
|
|
41
42
|
},
|
|
@@ -64,7 +65,7 @@
|
|
|
64
65
|
"build": "tsc",
|
|
65
66
|
"clean": "rm -rf dist",
|
|
66
67
|
"test": "vitest run",
|
|
67
|
-
"type-check": "tsc --noEmit",
|
|
68
|
+
"type-check": "tsc --noEmit && tsc -p tsconfig.typetests.json",
|
|
68
69
|
"lint": "eslint ."
|
|
69
70
|
}
|
|
70
71
|
}
|