@objectstack/platform-objects 12.6.0 → 14.3.0

package/dist/identity/index.mjs

@@ -35,13 +35,14 @@ var SysUser = ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
-      // Org invitations are a multi-org-only flow (the endpoint resolves
-      // an active org that does not exist in single-org mode). Hide the
-      // affordance unless multi-org is enabled — matching the
-      // `create_organization` gate on sys_organization. This action is the
-      // most exposed of the set because the Users list is always reachable
-      // in single-org, unlike the org/membership lists.
-      visible: "features.multiOrgEnabled != false",
+      // Gated on the org CAPABILITY, not multi-org (ADR-0081 D1): the
+      // better-auth organization plugin is always mounted, and single-org
+      // mode now bootstraps a Default Organization (plugin-auth) so the
+      // endpoint's active-org resolution works there too. This is THE
+      // "add a teammate" affordance — the Users list is always reachable —
+      // and every add flows through better-auth invitations, never bespoke
+      // sys_user CRUD.
+      visible: "features.organization != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -100,6 +101,62 @@ var SysUser = ObjectSchema.create({
       successMessage: "Account unlocked",
       refreshAfter: true
     },
+    {
+      // #2766 V1 — a platform admin can add a login-capable teammate without
+      // the email-dependent invite flow. Hits the plugin-auth wrapper route
+      // (NOT better-auth's stock /admin/create-user): the wrapper runs the
+      // ADR-0068 admin gate, drives the better-auth pipeline (scrypt hash +
+      // credential sys_account), stamps must_change_password, and — when
+      // "Generate temporary password" is picked — returns the password ONCE
+      // in the response for the result dialog. It is never persisted or logged.
+      name: "create_user",
+      label: "Create User",
+      icon: "user-plus",
+      variant: "secondary",
+      locations: ["list_toolbar"],
+      type: "api",
+      target: "/api/v1/auth/admin/create-user",
+      visible: "features.admin == true",
+      successMessage: "User created",
+      refreshAfter: true,
+      params: [
+        // The endpoint requires email OR phone (phone-only users get a
+        // placeholder address; requires auth.plugins.phoneNumber).
+        { field: "email", required: false },
+        {
+          name: "phoneNumber",
+          label: "Phone Number",
+          type: "text",
+          required: false,
+          helpText: "Sign-in phone number (E.164, e.g. +8613800000000). Required when no email is given."
+        },
+        { field: "name", required: false },
+        {
+          name: "generatePassword",
+          label: "Generate Temporary Password",
+          type: "boolean",
+          required: false,
+          defaultValue: true
+        },
+        { name: "password", label: "Password (leave empty to generate)", type: "text", required: false },
+        {
+          name: "mustChangePassword",
+          label: "Require Password Change On First Login",
+          type: "boolean",
+          required: false,
+          defaultValue: true
+        }
+      ],
+      resultDialog: {
+        title: "User Created",
+        description: "Copy the temporary password now \u2014 it is shown only once and never stored.",
+        acknowledge: "I have saved this password",
+        fields: [
+          { path: "user.email", label: "Email", format: "text" },
+          { path: "temporaryPassword", label: "Temporary Password", format: "secret" }
+        ]
+      }
+    },
     {
       name: "set_user_password",
       label: "Set Password",
@@ -107,13 +164,40 @@ var SysUser = ObjectSchema.create({
       variant: "secondary",
       locations: ["list_item"],
       type: "api",
+      // #2766 V1 — same path as better-auth's stock route, but served by the
+      // plugin-auth wrapper registered ahead of the catch-all: it accepts the
+      // ADR-0068 platform-admin signals (the stock handler only honors the
+      // legacy role scalar), can mint a temporary password, and stamps
+      // must_change_password.
       target: "/api/v1/auth/admin/set-user-password",
       recordIdParam: "userId",
       successMessage: "Password updated",
       refreshAfter: false,
       params: [
-        { name: "newPassword", label: "New Password", type: "text", required: true }
-      ]
+        {
+          name: "generatePassword",
+          label: "Generate Temporary Password",
+          type: "boolean",
+          required: false,
+          defaultValue: false
+        },
+        { name: "newPassword", label: "New Password (leave empty to generate)", type: "text", required: false },
+        {
+          name: "mustChangePassword",
+          label: "Require Password Change On Next Login",
+          type: "boolean",
+          required: false,
+          defaultValue: true
+        }
+      ],
+      resultDialog: {
+        title: "Password Updated",
+        description: "If a temporary password was generated, copy it now \u2014 it is shown only once and never stored.",
+        acknowledge: "Done",
+        fields: [
+          { path: "temporaryPassword", label: "Temporary Password", format: "secret" }
+        ]
+      }
     },
     {
       name: "set_user_role",
@@ -432,6 +516,37 @@ var SysUser = ObjectSchema.create({
       group: "Admin",
       description: "Timestamp of the last password change. Backs password_expiry_days; system-managed."
     }),
+    // #2766 V1.5 — phone-number sign-in identifier (better-auth phoneNumber
+    // plugin, mapped via buildPhoneNumberPluginSchema). Unique when present;
+    // null for email-only accounts. Written through better-auth, not CRUD.
+    phone_number: Field.text({
+      label: "Phone Number",
+      required: false,
+      readonly: true,
+      searchable: true,
+      maxLength: 32,
+      group: "Account",
+      description: "Sign-in phone number (E.164 recommended). Unique per user; managed by better-auth when the phoneNumber plugin is enabled."
+    }),
+    phone_number_verified: Field.boolean({
+      label: "Phone Verified",
+      defaultValue: false,
+      readonly: true,
+      group: "Account",
+      description: "Whether the phone number has been verified (OTP verification requires SMS infrastructure; false until that ships). System-managed."
+    }),
+    // #2766 V1 — admin-issued "must change password on next sign-in" flag.
+    // Set by the /admin/create-user and /admin/set-user-password routes when
+    // a temporary password is issued; enforced through the ADR-0069 authGate
+    // (surfaces as PASSWORD_EXPIRED); cleared by stampPasswordChangedAt once
+    // the user completes a password change.
+    must_change_password: Field.boolean({
+      label: "Must Change Password",
+      defaultValue: false,
+      readonly: true,
+      group: "Admin",
+      description: "When true, the user is blocked (403 PASSWORD_EXPIRED) until they change their password. Stamped by the admin user-management routes; system-managed."
+    }),
     // ADR-0069 D3 — when enforced MFA first applied to this user; starts the
     // grace clock. Stamped lazily at session validation; system-managed.
     mfa_required_at: Field.datetime({
@@ -529,7 +644,10 @@ var SysUser = ObjectSchema.create({
   },
   indexes: [
     { fields: ["email"], unique: true },
-    { fields: ["created_at"], unique: false }
+    { fields: ["created_at"], unique: false },
+    // #2766 V1.5 — phone sign-in identifier; unique when present (null for
+    // email-only accounts), also the upsert match key for identity import.
+    { fields: ["phone_number"], unique: true }
   ],
   enable: {
     trackHistory: true,
@@ -930,6 +1048,12 @@ var SysVerification = ObjectSchema.create({
   icon: "shield-check",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE one-time credentials
+  // (email/phone verification + password-reset tokens) — reading one is
+  // account takeover. Not covered by the wildcard `'*'` grant; admins retain
+  // access via the superuser bypass; better-auth reads via its adapter
+  // (system context), so verification flows are unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -1263,11 +1387,11 @@ var SysMember = ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/add-member",
-      // Org-membership mutations are multi-org-only: the better-auth
-      // endpoints resolve an active org that does not exist in single-org
-      // mode, so these actions would fail at the API. Gate every one on
-      // the multi-org flag (mirrors sys_organization.create_organization).
-      visible: "features.multiOrgEnabled != false",
+      // Gated on the org CAPABILITY, not multi-org (ADR-0081 D1): the
+      // better-auth endpoints resolve the session's active org, which
+      // single-org mode now guarantees via plugin-auth's default-org
+      // bootstrap. Same gate on every membership mutation below.
+      visible: "features.organization != false",
       successMessage: "Member added",
       refreshAfter: true,
       params: [
@@ -1285,7 +1409,7 @@ var SysMember = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Member role updated",
       refreshAfter: true,
       params: [
@@ -1302,7 +1426,7 @@ var SysMember = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-member",
       recordIdParam: "memberIdOrEmail",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Remove this member from the organization? They will lose access to all org resources.",
       successMessage: "Member removed",
       refreshAfter: true
@@ -1324,7 +1448,7 @@ var SysMember = ObjectSchema.create({
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
       bodyExtra: { role: "owner" },
-      visible: "record.role != 'owner' && features.multiOrgEnabled != false",
+      visible: "record.role != 'owner' && features.organization != false",
       confirmText: "Transfer ownership of this organization to the selected member? You will be demoted to admin and lose owner-only privileges.",
       successMessage: "Ownership transferred",
       refreshAfter: true
@@ -1432,7 +1556,7 @@ var SysInvitation = ObjectSchema.create({
       // sys_organization.create_organization). The recipient-side
       // accept/reject actions below stay record-gated — they are
       // unreachable in single-org anyway (no invitation rows exist).
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -1450,7 +1574,7 @@ var SysInvitation = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/cancel-invitation",
       recordIdParam: "invitationId",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Cancel this invitation? The recipient will no longer be able to accept it.",
       successMessage: "Invitation canceled",
       refreshAfter: true
@@ -1464,7 +1588,7 @@ var SysInvitation = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
       bodyExtra: { resend: true },
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Invitation resent",
       refreshAfter: true,
       params: [
@@ -1654,7 +1778,7 @@ var SysTeam = ObjectSchema.create({
       // Teams are nested inside organizations — a multi-org-only concept.
       // Gate every team mutation on the multi-org flag so the affordances
       // disappear in single-org (mirrors sys_organization.create_organization).
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Team created",
       refreshAfter: true,
       params: [
@@ -1675,7 +1799,7 @@ var SysTeam = ObjectSchema.create({
       target: "/api/v1/auth/organization/update-team",
       recordIdParam: "teamId",
       bodyShape: { wrap: "data" },
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Team updated",
       refreshAfter: true,
       params: [
@@ -1694,7 +1818,7 @@ var SysTeam = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-team",
       recordIdParam: "teamId",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Delete this team? Members will lose any team-scoped access. This cannot be undone.",
       successMessage: "Team deleted",
       refreshAfter: true
@@ -1808,7 +1932,7 @@ var SysTeamMember = ObjectSchema.create({
       // Team membership lives under organizations — multi-org-only. Gate
       // both mutations so they vanish in single-org (mirrors
       // sys_organization.create_organization).
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       successMessage: "Team member added",
       refreshAfter: true,
       params: [
@@ -1829,7 +1953,7 @@ var SysTeamMember = ObjectSchema.create({
       locations: ["list_item"],
       type: "api",
       target: "/api/v1/auth/organization/remove-team-member",
-      visible: "features.multiOrgEnabled != false",
+      visible: "features.organization != false",
       confirmText: "Remove this user from the team? They will lose any team-scoped access.",
       successMessage: "Team member removed",
       refreshAfter: true,
@@ -2067,7 +2191,7 @@ var SysBusinessUnitMember = ObjectSchema.create({
   managedBy: "platform",
   description: "User assignment to a business unit (matrix-org friendly, effective-dated).",
   titleFormat: "{user_id} in {business_unit_id}",
-  highlightFields: ["user_id", "business_unit_id", "role_in_business_unit", "is_primary"],
+  highlightFields: ["user_id", "business_unit_id", "function_in_business_unit", "is_primary"],
   fields: {
     id: Field.text({
       label: "Member ID",
@@ -2085,10 +2209,10 @@ var SysBusinessUnitMember = ObjectSchema.create({
       required: true,
       group: "Assignment"
     }),
-    role_in_business_unit: Field.select(
+    function_in_business_unit: Field.select(
       ["member", "lead", "deputy"],
       {
-        label: "Role in Business Unit",
+        label: "Function in Business Unit",
         required: false,
         defaultValue: "member",
         description: "`lead` is the day-to-day head; `deputy` may stand in for the lead in approval routing.",
@@ -2492,6 +2616,12 @@ var SysDeviceCode = ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE pending device-grant
+  // codes — reading `user_code`/`device_code` lets an attacker hijack a
+  // pending CLI login. Not covered by the wildcard `'*'` grant; admins retain
+  // access via the superuser bypass; better-auth reads via its adapter
+  // (system context), so the device-grant flow is unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3087,6 +3217,11 @@ var SysOauthAccessToken = ObjectSchema.create({
   icon: "ticket",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE bearer credentials —
+  // reading one is session hijack. Not covered by the wildcard `'*'` grant;
+  // admins retain access via the superuser bypass; better-auth reads via its
+  // adapter (system context), so OAuth flows are unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3173,6 +3308,11 @@ var SysOauthRefreshToken = ObjectSchema.create({
   icon: "refresh-cw",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are LIVE long-lived credentials —
+  // a refresh token mints new access tokens. Not covered by the wildcard `'*'`
+  // grant; admins retain access via the superuser bypass; better-auth reads
+  // via its adapter (system context), so OAuth flows are unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3331,6 +3471,13 @@ var SysJwks = ObjectSchema.create({
   icon: "key",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D2/④] Secure-by-default: rows are the environment's JWT SIGNING
+  // KEYS (private key material). Not covered by the wildcard `'*'` grant — an
+  // ordinary member gets 403 from the generic data layer. Platform admins
+  // (viewAllRecords/modifyAllRecords) retain access via the posture-gated
+  // superuser bypass; better-auth itself reads via its adapter (system
+  // context), so token signing/verification is unaffected.
+  access: { default: "private" },
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
   // but may add overlay row-level config. Use `no-overlay` if you need to
   // forbid sys_metadata overlays entirely.
@@ -3644,6 +3791,14 @@ var SysScimProvider = ObjectSchema.create({
   icon: "users",
   isSystem: true,
   managedBy: "better-auth",
+  // [ADR-0066 D3/④] Admin-only identity config carrying a live credential
+  // (`scim_token` — the bearer external IdPs authenticate provisioning calls
+  // with). Object-level capability gate, mirroring the sibling
+  // `sys_sso_provider`: ordinary members are denied entirely (without it, the
+  // `member_default` wildcard `'*': allowRead` would expose SCIM connections
+  // to every authenticated user). better-auth's own endpoints read via a
+  // system context, so SCIM provisioning is unaffected.
+  requiredPermissions: ["manage_platform_settings"],
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
   protection: {
     lock: "full",