@objectstack/plugin-auth 6.6.0 → 6.7.1

package/dist/index.d.mts

@@ -336,6 +336,7 @@ declare class AuthManager {
             passkeys: boolean;
             magicLink: boolean;
             organization: boolean;
+            multiOrgEnabled: boolean;
             oidcProvider: boolean;
             deviceAuthorization: boolean;
         };

package/dist/index.d.ts

@@ -336,6 +336,7 @@ declare class AuthManager {
             passkeys: boolean;
             magicLink: boolean;
             organization: boolean;
+            multiOrgEnabled: boolean;
             oidcProvider: boolean;
             deviceAuthorization: boolean;
         };

package/dist/index.js

@@ -895,6 +895,22 @@ var AuthManager = class {
         // never seed `sys_environment`) keep working: any lookup error
         // is treated as "no envs to protect".
         organizationHooks: {
+          // Gate fresh organization creation behind `OS_MULTI_ORG_ENABLED`.
+          // The plugin itself is always installed (so list/update/invite endpoints
+          // keep responding); only the `create` operation is denied when the
+          // deployment is provisioned in single-org mode. Default is enabled
+          // to preserve historical behaviour.
+          beforeCreateOrganization: async () => {
+            const flag = String(
+              globalThis?.process?.env?.OS_MULTI_ORG_ENABLED ?? "true"
+            ).toLowerCase();
+            if (flag === "false") {
+              const { APIError } = await import("better-auth/api");
+              throw new APIError("FORBIDDEN", {
+                message: "Creating additional organizations is disabled on this deployment."
+              });
+            }
+          },
           beforeUpdateOrganization: async ({ organization: organization2, member }) => {
             const newSlug = organization2?.slug;
             const orgId = member?.organizationId;
@@ -1275,11 +1291,15 @@ var AuthManager = class {
       requireEmailVerification: emailPasswordConfig.requireEmailVerification ?? false
     };
     const pluginConfig = this.config.plugins ?? {};
+    const multiOrgEnabled = String(
+      globalThis?.process?.env?.OS_MULTI_ORG_ENABLED ?? "true"
+    ).toLowerCase() !== "false";
     const features = {
       twoFactor: pluginConfig.twoFactor ?? false,
       passkeys: pluginConfig.passkeys ?? false,
       magicLink: pluginConfig.magicLink ?? false,
       organization: pluginConfig.organization ?? true,
+      multiOrgEnabled,
       oidcProvider: pluginConfig.oidcProvider ?? false,
       deviceAuthorization: pluginConfig.deviceAuthorization ?? false
     };
@@ -1380,7 +1400,7 @@ var AuthPlugin = class {
       // (e.g. legacy `users.view` had phone/status/active columns that do
       // not exist on sys_user). Schema-embedded listViews is the single
       // source of truth.
-      dashboards: [import_apps.SystemOverviewDashboard, import_apps.SecurityOverviewDashboard]
+      dashboards: [import_apps.SystemOverviewDashboard]
     });
     ctx.logger.info("Auth Plugin initialized successfully");
   }