@objectstack/platform-objects 12.5.0 → 13.0.0

package/dist/identity/index.mjs

@@ -35,13 +35,14 @@ var SysUser = ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
-      // Org invitations are a multi-org-only flow (the endpoint resolves
-      // an active org that does not exist in single-org mode). Hide the
-      // affordance unless multi-org is enabled — matching the
-      // `create_organization` gate on sys_organization. This action is the
-      // most exposed of the set because the Users list is always reachable
-      // in single-org, unlike the org/membership lists.
-      visible: "features.multiOrgEnabled != false",
+      // Gated on the org CAPABILITY, not multi-org (ADR-0081 D1): the
+      // better-auth organization plugin is always mounted, and single-org
+      // mode now bootstraps a Default Organization (plugin-auth) so the
+      // endpoint's active-org resolution works there too. This is THE
+      // "add a teammate" affordance — the Users list is always reachable —
+      // and every add flows through better-auth invitations, never bespoke
+      // sys_user CRUD.
+      visible: "features.organization != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -930,6 +931,12 @@ var SysVerification = ObjectSchema.create({
   icon: "shield-check",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE one-time credentials
+  // (email/phone verification + password-reset tokens) — reading one is
+  // account takeover. Not covered by the wildcard `'*'` grant; admins retain
+  // access via the superuser bypass; better-auth reads via its adapter
+  // (system context), so verification flows are unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -1263,11 +1270,11 @@ var SysMember = ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/add-member",
-      // Org-membership mutations are multi-org-only: the better-auth
-      // endpoints resolve an active org that does not exist in single-org
-      // mode, so these actions would fail at the API. Gate every one on
-      // the multi-org flag (mirrors sys_organization.create_organization).
-      visible: "features.multiOrgEnabled != false",
+      // Gated on the org CAPABILITY, not multi-org (ADR-0081 D1): the
+      // better-auth endpoints resolve the session's active org, which
+      // single-org mode now guarantees via plugin-auth's default-org
+      // bootstrap. Same gate on every membership mutation below.
+      visible: "features.organization != false",
       successMessage: "Member added",
       refreshAfter: true,
       params: [
@@ -1285,7 +1292,7 @@ var SysMember = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Member role updated",
       refreshAfter: true,
       params: [
@@ -1302,7 +1309,7 @@ var SysMember = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-member",
       recordIdParam: "memberIdOrEmail",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Remove this member from the organization? They will lose access to all org resources.",
       successMessage: "Member removed",
       refreshAfter: true
@@ -1324,7 +1331,7 @@ var SysMember = ObjectSchema.create({
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
       bodyExtra: { role: "owner" },
-      visible: "record.role != 'owner' && features.multiOrgEnabled != false",
+      visible: "record.role != 'owner' && features.organization != false",
       confirmText: "Transfer ownership of this organization to the selected member? You will be demoted to admin and lose owner-only privileges.",
       successMessage: "Ownership transferred",
       refreshAfter: true
@@ -1432,7 +1439,7 @@ var SysInvitation = ObjectSchema.create({
       // sys_organization.create_organization). The recipient-side
       // accept/reject actions below stay record-gated — they are
       // unreachable in single-org anyway (no invitation rows exist).
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -1450,7 +1457,7 @@ var SysInvitation = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/cancel-invitation",
       recordIdParam: "invitationId",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Cancel this invitation? The recipient will no longer be able to accept it.",
       successMessage: "Invitation canceled",
       refreshAfter: true
@@ -1464,7 +1471,7 @@ var SysInvitation = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
       bodyExtra: { resend: true },
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Invitation resent",
       refreshAfter: true,
       params: [
@@ -1654,7 +1661,7 @@ var SysTeam = ObjectSchema.create({
       // Teams are nested inside organizations — a multi-org-only concept.
       // Gate every team mutation on the multi-org flag so the affordances
       // disappear in single-org (mirrors sys_organization.create_organization).
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Team created",
       refreshAfter: true,
       params: [
@@ -1675,7 +1682,7 @@ var SysTeam = ObjectSchema.create({
       target: "/api/v1/auth/organization/update-team",
       recordIdParam: "teamId",
       bodyShape: { wrap: "data" },
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Team updated",
       refreshAfter: true,
       params: [
@@ -1694,7 +1701,7 @@ var SysTeam = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-team",
       recordIdParam: "teamId",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Delete this team? Members will lose any team-scoped access. This cannot be undone.",
       successMessage: "Team deleted",
       refreshAfter: true
@@ -1808,7 +1815,7 @@ var SysTeamMember = ObjectSchema.create({
       // Team membership lives under organizations — multi-org-only. Gate
       // both mutations so they vanish in single-org (mirrors
       // sys_organization.create_organization).
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Team member added",
       refreshAfter: true,
       params: [
@@ -1829,7 +1836,7 @@ var SysTeamMember = ObjectSchema.create({
       locations: ["list_item"],
       type: "api",
       target: "/api/v1/auth/organization/remove-team-member",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Remove this user from the team? They will lose any team-scoped access.",
       successMessage: "Team member removed",
       refreshAfter: true,
@@ -2067,7 +2074,7 @@ var SysBusinessUnitMember = ObjectSchema.create({
   managedBy: "platform",
   description: "User assignment to a business unit (matrix-org friendly, effective-dated).",
   titleFormat: "{user_id} in {business_unit_id}",
-  highlightFields: ["user_id", "business_unit_id", "role_in_business_unit", "is_primary"],
+  highlightFields: ["user_id", "business_unit_id", "function_in_business_unit", "is_primary"],
   fields: {
     id: Field.text({
       label: "Member ID",
@@ -2085,10 +2092,10 @@ var SysBusinessUnitMember = ObjectSchema.create({
       required: true,
       group: "Assignment"
     }),
-    role_in_business_unit: Field.select(
+    function_in_business_unit: Field.select(
       ["member", "lead", "deputy"],
       {
-        label: "Role in Business Unit",
+        label: "Function in Business Unit",
         required: false,
         defaultValue: "member",
         description: "`lead` is the day-to-day head; `deputy` may stand in for the lead in approval routing.",
@@ -2492,6 +2499,12 @@ var SysDeviceCode = ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE pending device-grant
+  // codes — reading `user_code`/`device_code` lets an attacker hijack a
+  // pending CLI login. Not covered by the wildcard `'*'` grant; admins retain
+  // access via the superuser bypass; better-auth reads via its adapter
+  // (system context), so the device-grant flow is unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3087,6 +3100,11 @@ var SysOauthAccessToken = ObjectSchema.create({
   icon: "ticket",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE bearer credentials —
+  // reading one is session hijack. Not covered by the wildcard `'*'` grant;
+  // admins retain access via the superuser bypass; better-auth reads via its
+  // adapter (system context), so OAuth flows are unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3173,6 +3191,11 @@ var SysOauthRefreshToken = ObjectSchema.create({
   icon: "refresh-cw",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE long-lived credentials —
+  // a refresh token mints new access tokens. Not covered by the wildcard `'*'`
+  // grant; admins retain access via the superuser bypass; better-auth reads
+  // via its adapter (system context), so OAuth flows are unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3331,6 +3354,13 @@ var SysJwks = ObjectSchema.create({
   icon: "key",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are the environment's JWT SIGNING
+  // KEYS (private key material). Not covered by the wildcard `'*'` grant — an
+  // ordinary member gets 403 from the generic data layer. Platform admins
+  // (viewAllRecords/modifyAllRecords) retain access via the posture-gated
+  // superuser bypass; better-auth itself reads via its adapter (system
+  // context), so token signing/verification is unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3644,6 +3674,14 @@ var SysScimProvider = ObjectSchema.create({
   icon: "users",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D3/④] Admin-only identity config carrying a live credential
+  // (`scim_token` — the bearer external IdPs authenticate provisioning calls
+  // with). Object-level capability gate, mirroring the sibling
+  // `sys_sso_provider`: ordinary members are denied entirely (without it, the
+  // `member_default` wildcard `'*': allowRead` would expose SCIM connections
+  // to every authenticated user). better-auth's own endpoints read via a
+  // system context, so SCIM provisioning is unaffected.
+  requiredPermissions: ["manage_platform_settings"],
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
   protection: {
     lock: "full",