@odla-ai/chapter 0.46.0 → 0.47.0

package/dist/worker/index.d.cts

@@ -514,7 +514,7 @@ interface ChapterScheduling {
  *
  * - `"claim"` reads a role ladder from a JWT claim (the member-site model:
  *   `provisional → member → admin`). Admin is the last (highest) rung; the
- *   read-only `superAdmins` tier sits above it.
+ *   Studio-managed super-admin tier sits above it.
  * - `"table"` gates on the deny-all `admins` allowlist (the hub model):
  *   a binary "email is an admin or isn't", set only in odla Studio.
  *
@@ -526,10 +526,13 @@ interface ChapterAuth {
     /** Role ladder low→high, for `source: "claim"`. The last entry is admin.
      *  Default `["provisional", "member", "admin"]`. */
     ladder?: readonly string[];
-    /** Provision the read-only `superAdmins` tier table — the only tier that may
-     *  create/modify admins, and (like every namespace) deny-all + written only in
-     *  odla Studio. Default: `true` for `"claim"`, `false` for `"table"`. */
+    /** Enable the Studio-managed super-admin tier — the only tier that may
+     *  create/modify admins. Default: `true` for `"claim"`, `false` for `"table"`. */
     superAdmins?: boolean;
+    /** Authority behind the super-admin tier. `"table"` preserves the legacy
+     * app allowlist; `"odla"` reads protected `$users.role`. Default `"table"`
+     * for backward compatibility. */
+    superAdminSource?: "table" | "odla";
 }
 /** The fully-resolved auth policy (defaults applied) carried on the {@link Chapter}. */
 interface ResolvedAuth {
@@ -539,6 +542,7 @@ interface ResolvedAuth {
     /** The highest ladder rung (last entry) — the "admin" gate. */
     adminRole: string;
     superAdmins: boolean;
+    superAdminSource: "none" | "table" | "odla";
 }
 /** The application status pipeline. Which statuses exist, and the subsets a site
  *  allows a call to be booked from / an application approved from. Defaults to

package/dist/worker/index.d.ts

@@ -514,7 +514,7 @@ interface ChapterScheduling {
  *
  * - `"claim"` reads a role ladder from a JWT claim (the member-site model:
  *   `provisional → member → admin`). Admin is the last (highest) rung; the
- *   read-only `superAdmins` tier sits above it.
+ *   Studio-managed super-admin tier sits above it.
  * - `"table"` gates on the deny-all `admins` allowlist (the hub model):
  *   a binary "email is an admin or isn't", set only in odla Studio.
  *
@@ -526,10 +526,13 @@ interface ChapterAuth {
     /** Role ladder low→high, for `source: "claim"`. The last entry is admin.
      *  Default `["provisional", "member", "admin"]`. */
     ladder?: readonly string[];
-    /** Provision the read-only `superAdmins` tier table — the only tier that may
-     *  create/modify admins, and (like every namespace) deny-all + written only in
-     *  odla Studio. Default: `true` for `"claim"`, `false` for `"table"`. */
+    /** Enable the Studio-managed super-admin tier — the only tier that may
+     *  create/modify admins. Default: `true` for `"claim"`, `false` for `"table"`. */
     superAdmins?: boolean;
+    /** Authority behind the super-admin tier. `"table"` preserves the legacy
+     * app allowlist; `"odla"` reads protected `$users.role`. Default `"table"`
+     * for backward compatibility. */
+    superAdminSource?: "table" | "odla";
 }
 /** The fully-resolved auth policy (defaults applied) carried on the {@link Chapter}. */
 interface ResolvedAuth {
@@ -539,6 +542,7 @@ interface ResolvedAuth {
     /** The highest ladder rung (last entry) — the "admin" gate. */
     adminRole: string;
     superAdmins: boolean;
+    superAdminSource: "none" | "table" | "odla";
 }
 /** The application status pipeline. Which statuses exist, and the subsets a site
  *  allows a call to be booked from / an application approved from. Defaults to

package/dist/worker/index.js

@@ -80,12 +80,16 @@ function createWorkerContext(options) {
   }
   async function isAdminEmail(db, email) {
     if (!email) return false;
-    const { admins } = await db.query({ admins: { $: { where: { email: email.toLowerCase() }, limit: 1 } } });
+    const { admins } = await db.query({ admins: { $: { where: { email: email.trim().toLowerCase() }, limit: 1 } } });
     return Array.isArray(admins) && admins.length > 0;
   }
   async function isSuperAdminEmail(db, email) {
     if (!auth.superAdmins || !email) return false;
-    const { superAdmins } = await db.query({ superAdmins: { $: { where: { email: email.toLowerCase() }, limit: 1 } } });
+    if (auth.superAdminSource === "odla") {
+      const { $users } = await db.query({ $users: { $: { where: { email: email.trim().toLowerCase(), role: "super_admin" }, limit: 1 } } });
+      return Array.isArray($users) && $users.length > 0;
+    }
+    const { superAdmins } = await db.query({ superAdmins: { $: { where: { email: email.trim().toLowerCase() }, limit: 1 } } });
     return Array.isArray(superAdmins) && superAdmins.length > 0;
   }
   async function roleFor(db, u) {