@plandesk/api 1.0.0-beta.3 → 1.0.0-beta.4

package/dist/access-control.d.ts

@@ -90,6 +90,7 @@ export declare const member: import("better-auth/plugins/access").Role<import("b
 }>;
 export declare const admin: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
     readonly project: ["create", "delete"];
+    readonly invitation: ["create", "cancel"];
     readonly task: readonly ["read", "create", "update", "delete"];
     readonly document: readonly ["read", "create", "update", "delete"];
     readonly edge: readonly ["read", "create", "update", "delete"];
@@ -98,7 +99,6 @@ export declare const admin: import("better-auth/plugins/access").Role<import("be
     readonly agent_run: readonly ["read", "create", "update", "delete"];
     readonly organization: readonly [];
     readonly member: readonly [];
-    readonly invitation: readonly [];
     readonly team: readonly [];
     readonly ac: readonly [];
     readonly apiKey: readonly [];

package/dist/access-control.js

@@ -35,6 +35,10 @@ export const member = ac.newRole(memberPermissions);
 export const admin = ac.newRole({
     ...memberPermissions,
     project: ['create', 'delete'],
+    // Admins can invite teammates (as member or admin) and cancel invites, but
+    // cannot manage members directly (member:update/delete) or mint owners —
+    // better-auth blocks a non-owner inviting the creatorRole. Owner-only stays owner-only.
+    invitation: ['create', 'cancel'],
 });
 export const owner = ac.newRole({
     ...memberPermissions,

package/dist/routes/orgs.js

@@ -122,8 +122,9 @@ export function createOrgsRouter(db, options = {}) {
         return c.json({ members }, 200);
     });
     /**
-     * BA3c: invite by email (link-only, no mailer). Session owner only
-     * (member:create). Returns claimUrl for the inviter to deliver by hand.
+     * BA3c: invite by email (link-only, no mailer). Owners and admins may invite
+     * (invitation:create); better-auth still blocks a non-owner inviting an owner.
+     * Returns claimUrl for the inviter to deliver by hand.
      */
     router.post('/orgs/:id/invitations', async (c) => {
         const orgId = c.req.param('id');
@@ -131,11 +132,11 @@ export function createOrgsRouter(db, options = {}) {
             return c.json({ error: 'not_found' }, 404);
         }
         const authCtx = getOrgAuthContext();
-        // Session owner only — token/loopback cannot drive better-auth createInvitation.
+        // Session only — token/loopback cannot drive better-auth createInvitation.
         if (authCtx.kind !== 'session') {
             return c.json({ error: 'forbidden' }, 403);
         }
-        requirePermission(authCtx, 'member', 'create');
+        requirePermission(authCtx, 'invitation', 'create');
         if (betterAuth === undefined) {
             return c.json({ error: 'unavailable' }, 503);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plandesk/api",
-  "version": "1.0.0-beta.3",
+  "version": "1.0.0-beta.4",
   "type": "module",
   "exports": {
     ".": {
@@ -26,7 +26,7 @@
     "@libsql/kysely-libsql": "^0.4.1",
     "better-auth": "1.6.23",
     "hono": "^4.12.23",
-    "@plandesk/db": "1.0.0-beta.3"
+    "@plandesk/db": "1.0.0-beta.4"
   },
   "description": "Plan Desk REST + SSE API and service layer (local-first planning workspace).",
   "license": "MIT",