@protobase/server 0.46.5 → 0.46.7

package/dist/aggregate-service.js

@@ -1,14 +1,15 @@
 import { badRequest } from "./problem.js";
 import { checkedFilter } from "./filter-input.js";
-import { readScope, requestAccess, requireOperation } from "./request-access.js";
+import { requestAccess, requireOperation } from "./request-access.js";
 import { readTransaction } from "./transactions.js";
 import { columnId, filterCondition, scopeConditions, tableId, whereClause } from "./sql-parts.js";
 import { parseParams } from "./params.js";
+import { readScope } from "./read-scope.js";
 import { labelRequests, relatedLabels } from "./related-labels.js";
 import { rangeEnd, rangeStart } from "./range-ends.js";
 import { z } from "zod";
 import { sql } from "kysely";
-import { facetCounts, histogram, series, withoutField } from "@protobase/query";
+import { facetCounts, histogram, series, tenantCondition, withoutField } from "@protobase/query";
 //#region src/aggregate-service.ts
 const field = z.string().min(1);
 const filter = z.string().optional();
@@ -64,7 +65,7 @@ const scoped = async (deps, entry, session, source) => {
 		access,
 		model: access.model,
 		filter: checkedFilter(access.model, source),
-		scope: readScope(access)
+		scope: await readScope(access)
 	};
 };
 /**
@@ -108,7 +109,12 @@ const facets = async (deps, entry, session, input) => {
 };
 const earliest = async (deps, access, fieldName, scope) => {
 	const target = access.model.fields[fieldName];
-	const conditions = [...scopeConditions(access.full, scope.tenantValue), ...filterCondition(access.full, scope.rowFilter)];
+	const across = scope.tenantValues ? [tenantCondition(access.full, scope)] : [];
+	const conditions = [
+		...scopeConditions(access.full, scope.tenantValue),
+		...across,
+		...filterCondition(access.full, scope.rowFilter)
+	];
 	return (await readTransaction(deps.db, deps.statementTimeoutMs, (trx) => sql`select min(${columnId(target)})::text as lowest from ${tableId(access.full)} as t${whereClause(conditions)}`.execute(trx))).rows[0]?.lowest ?? void 0;
 };
 const bound = (model, fieldName, value) => model.fields[fieldName]?.type === "date" ? value.slice(0, 10) : value;

package/dist/better-auth/authenticator.d.ts

@@ -49,7 +49,8 @@ export declare const betterAuthTokens: (options: Pick<BetterAuthAuthenticatorOpt
  * organization, and the membership's `app_roles` are added to the global roles; `user`, which stands for no global
  * role, is left out. With `auth`, every request also reads the store to check that the token still stands
  * (`checkTokenStanding`), so a ban, a lowered role, a deleted user or a sign-out ends it at once; with `jwksUrl` alone
- * a token works until it expires. With `apps`, the tokens of those apps are admitted too, with the roles each gives
+ * a token works until it expires. With organizations and `auth`, the session's `memberships` reads the person's
+ * organizations from the store when a list across them asks (`sessionMemberships`). With `apps`, the tokens of those apps are admitted too, with the roles each gives
  * its users here.
  */
 export declare const betterAuthAuthenticator: (options: BetterAuthAuthenticatorOptions) => BetterAuthAuthenticator;

package/dist/better-auth/authenticator.js

@@ -3,6 +3,7 @@ import { noGlobalRole } from "./organizations/role-definitions.js";
 import { cachedKeys } from "./jwks-cache.js";
 import { withTrustedApps } from "./app-tokens.js";
 import { checkMcpGrant } from "./mcp/grant-standing.js";
+import { sessionMemberships } from "./organizations/session-memberships.js";
 import { checkTokenStanding, checkUserStanding, tokenClaims } from "./token-standing.js";
 import { createDpopReplayStore, createInMemoryDpopReplayStore } from "better-auth/oauth2";
 //#region src/better-auth/authenticator.ts
@@ -23,7 +24,8 @@ const betterAuthTokens = (options) => {
 * organization, and the membership's `app_roles` are added to the global roles; `user`, which stands for no global
 * role, is left out. With `auth`, every request also reads the store to check that the token still stands
 * (`checkTokenStanding`), so a ban, a lowered role, a deleted user or a sign-out ends it at once; with `jwksUrl` alone
-* a token works until it expires. With `apps`, the tokens of those apps are admitted too, with the roles each gives
+* a token works until it expires. With organizations and `auth`, the session's `memberships` reads the person's
+* organizations from the store when a list across them asks (`sessionMemberships`). With `apps`, the tokens of those apps are admitted too, with the roles each gives
 * its users here.
 */
 const betterAuthAuthenticator = (options) => {
@@ -58,10 +60,13 @@ const betterAuthAuthenticator = (options) => {
 				...session.user,
 				roles: session.user.roles.filter((role) => role !== noGlobalRole)
 			};
+			let memberships;
+			const across = auth && !verifyOptions.oauthClient && { memberships: async () => memberships ??= auth.$context.then((context) => sessionMemberships(context, String(user.id), user.roles)) };
 			return {
 				...session,
 				user,
-				...session.tenant !== void 0 && { organization: { id: session.tenant } }
+				...session.tenant !== void 0 && { organization: { id: session.tenant } },
+				...across
 			};
 		};
 	};

package/dist/better-auth/organizations/session-memberships.js

@@ -0,0 +1,29 @@
+import { effectiveRoles, globalRoles } from "./app-roles.js";
+import { membershipsOf } from "./store.js";
+import { resolveActiveRole } from "../roles/active-role.js";
+//#region src/better-auth/organizations/session-memberships.ts
+/**
+* The organizations someone is a member of, read from the store, each with the role they would act with there after a
+* switch: the session's active role (`active`) when they hold it there, globally or as the member, else their first
+* role there, else none. Organizations they only enter with a global role are not memberships, so they are left out.
+*/
+const sessionMemberships = async ({ adapter }, userId, active) => {
+	const user = await adapter.findOne({
+		model: "user",
+		where: [{
+			field: "id",
+			value: userId
+		}]
+	});
+	if (!user) return [];
+	const global = globalRoles(user.role);
+	return (await membershipsOf(adapter, userId)).map((member) => {
+		const role = resolveActiveRole(effectiveRoles(global, member.appRoles), active);
+		return {
+			tenant: member.organizationId,
+			roles: role === void 0 ? [] : [role]
+		};
+	});
+};
+//#endregion
+export { sessionMemberships };

package/dist/index.d.ts

@@ -18,7 +18,7 @@ import { HistoryPosition, NewNotification, StoredNotification, historyIdPattern,
 import { PushMessage, PushMessageError, Urgency, WebPushFields, maxTtlSeconds, pushMessage, urgencies } from "./notifications/message.js";
 import { NotificationRecipients, NotificationSendError, SendNotification, maxMessageBytes, maxRecipients } from "./notifications/send-input.js";
 import { EnqueueOptions, JobContext, JobDefinition, JobOptions } from "./jobs/job-types.js";
-import { Admin, AuditEvent, AuditQueue, Authenticator, PipelineHook, ScanGuardMode, Session, SessionOrganization, TenantValue, User, ViewSource, WriteEvent, WriteOperation } from "./types.js";
+import { Admin, AuditEvent, AuditQueue, Authenticator, Membership, PipelineHook, ScanGuardMode, Session, SessionOrganization, TenantValue, User, ViewSource, WriteEvent, WriteOperation } from "./types.js";
 import { CommentUsers } from "./comments/comment-users.js";
 import { HistoryOptions } from "./history/options.js";
 import { WebhooksOptions } from "./webhooks/table/options.js";
@@ -161,4 +161,4 @@ import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.
 import { MobileRelease, ReleaseFile, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { MobileReleaseAppInput, OfferedRelease, mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpApprovals, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, type Membership, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationRecipients, NotificationSendError, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type SendNotification, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxMessageBytes, maxRecipients, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpApprovals, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sendNotification, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/list-photos.js

@@ -1,9 +1,10 @@
 import { badRequest } from "./problem.js";
 import { checkedSort } from "./filter-input.js";
-import { readScope, requestAccess } from "./request-access.js";
+import { requestAccess } from "./request-access.js";
 import { readTransaction } from "./transactions.js";
 import { exposeRow } from "./rows.js";
 import { presentFiles } from "./files/present.js";
+import { readScope } from "./read-scope.js";
 import { cardPhotosErrors } from "./view-card-photos.js";
 import { cardPhotoLimit } from "@protobase/schema/internal";
 import { checkFilter, createWhere } from "@protobase/schema";
@@ -66,7 +67,7 @@ const recordPhotos = async (deps, request, model, rows) => {
 	const sort = checkedSort(access.model, photos.sort);
 	const filter = checkFilter(access.model, where$1.in(photos.field, keys));
 	if (!filter.ok) throw new Error(`Keys of "${model.name}" do not make a filter of "${photos.resource}": ${filter.errors[0].message}`);
-	const scope = readScope(access);
+	const scope = await readScope(access);
 	const warning = await deps.guard(access.entry, {
 		filter: filter.filter,
 		...sort && { sort }

package/dist/list-service.js

@@ -1,11 +1,12 @@
 import { checkedFilter, checkedSort } from "./filter-input.js";
-import { readScope, requestAccess, requireOperation } from "./request-access.js";
+import { requestAccess, requireOperation } from "./request-access.js";
 import { readTransaction } from "./transactions.js";
 import { etagAlias } from "./sql-parts.js";
 import { etagOf } from "./etag.js";
 import { exposeRow, pickFields } from "./rows.js";
 import { presentFiles } from "./files/present.js";
 import { deletedRows, listParams, pageSizeOf, parseParams, seekParams, selectedFields } from "./params.js";
+import { readScope } from "./read-scope.js";
 import { rowPermissions } from "./row-permissions.js";
 import { labelRequests, relatedLabels } from "./related-labels.js";
 import { photosRequest, recordPhotos } from "./list-photos.js";
@@ -38,7 +39,7 @@ const listRecords = async (deps, entry, session, input, maxFilterLength, jump =
 	const labels = await labelRequests(deps, session, model, columns, params.labels);
 	const photos = await photosRequest(deps, session, model, params.photos, params.photos_order_by);
 	const limit = pageSizeOf(params.page_size);
-	const scope = readScope(access, full);
+	const scope = await readScope(access, full);
 	const etagField = entry.etag && !model.fields[entry.etag.field.name] ? full.fields[entry.etag.field.name] : void 0;
 	const queryModel = etagField ? {
 		...model,
@@ -48,7 +49,8 @@ const listRecords = async (deps, entry, session, input, maxFilterLength, jump =
 		}
 	} : model;
 	const withKey = (photos !== void 0 || columns?.some((name) => model.fields[name].type === "file")) && columns ? [.../* @__PURE__ */ new Set([...columns, ...entry.model.primaryKey.filter((name) => model.fields[name])])] : columns;
-	const read = entry.etag && withKey ? withKey : Object.keys(model.fields);
+	const across = model.tenantAcross && model.tenant !== void 0 ? [model.tenant] : [];
+	const read = entry.etag && withKey ? [.../* @__PURE__ */ new Set([...withKey, ...across])] : Object.keys(model.fields);
 	const shape = {
 		...filter && { filter },
 		...sort && { sort },

package/dist/map-service.js

@@ -1,7 +1,8 @@
 import { checkedFilter } from "./filter-input.js";
-import { readScope, requestAccess, requireOperation } from "./request-access.js";
+import { requestAccess, requireOperation } from "./request-access.js";
 import { readTransaction } from "./transactions.js";
 import { parseParams, selectedFields } from "./params.js";
+import { readScope } from "./read-scope.js";
 import { labelRequests } from "./related-labels.js";
 import { photosRequest } from "./list-photos.js";
 import { listRecords } from "./list-service.js";
@@ -33,7 +34,7 @@ const mapRecords = async (deps, entry, session, input) => {
 	};
 	checkMapPosition(access.model, position);
 	const filter = checkedFilter(access.model, params.filter);
-	const scope = readScope(access);
+	const scope = await readScope(access);
 	const found = await readTransaction(deps.db, deps.statementTimeoutMs, (trx) => countUpTo(trx, access.model, 201, filter, scope));
 	if (found <= 200 || params.zoom >= 16) {
 		const { latitude: _latitude, longitude: _longitude, zoom: _zoom, ...asked } = params;

package/dist/meta.js

@@ -5,6 +5,7 @@ import { pruneView } from "./view-access.js";
 import { activeRole } from "./active-role.js";
 import { pluginsFor } from "./plugins/plugin-settings.js";
 import { metaModel } from "./meta-model.js";
+import { withCurrentTenant } from "./nav-tenant.js";
 import { protobaseVersion } from "./protobase-version.js";
 import { seesRuntime } from "./runtime/runtime-settings.js";
 import { sourcesFor } from "./sources/source-settings.js";
@@ -46,7 +47,7 @@ const createMeta = (deps, appName, appIcon) => {
 			}] : [];
 		});
 		const createPages = new Set(picked.filter(({ view }) => view.create).map(({ view }) => view.resource));
-		const views = picked.map(({ access, view }) => pruneView(view, access.readable, listed, prompted, createPages, new Set(writeOnlyFields(access))));
+		const views = picked.map(({ access, view }) => withCurrentTenant(pruneView(view, access.readable, listed, prompted, createPages, new Set(writeOnlyFields(access))), access.model.tenant, session.tenant));
 		const callerAccess = {
 			createPages,
 			models: listed,

package/dist/nav-tenant.js

@@ -0,0 +1,42 @@
+import { parseFilter, printFilter, where } from "@protobase/schema";
+//#region src/nav-tenant.ts
+const narrowed = (filter, field, tenant) => {
+	const term = where.eq(field, tenant);
+	const parsed = filter?.trim() ? parseFilter(filter) : void 0;
+	if (parsed && !parsed.ok) throw new Error(`The filter "${filter}" does not parse: ${parsed.errors[0].message}`);
+	return printFilter(parsed?.ast ? where.and(parsed.ast, term) : term);
+};
+const onTenant = (entry, field, tenant) => {
+	if (entry.nav?.tenant !== "current" || !entry.list) return entry;
+	const recent = entry.nav.recent && {
+		...entry.nav.recent,
+		filter: narrowed(entry.nav.recent.filter, field, tenant)
+	};
+	const nav = {
+		...entry.nav,
+		...recent && { recent }
+	};
+	return {
+		...entry,
+		nav,
+		list: {
+			...entry.list,
+			filter: narrowed(entry.list.filter, field, tenant)
+		}
+	};
+};
+/**
+* The view as `/meta` gives it to a caller in `tenant`: each entry whose `nav.tenant` is `current`, the view's own and
+* its named lists', opens its list on that tenant, with `tenantField = "<tenant>"` added to the list's opening filter
+* and its recent records' filter. Unchanged for a caller who cannot see the tenant field, or works in no tenant.
+*/
+const withCurrentTenant = (view, tenantField, tenant) => {
+	if (tenantField === void 0 || tenant === void 0) return view;
+	const own = onTenant(view, tenantField, tenant);
+	return own.lists ? {
+		...own,
+		lists: own.lists.map((list) => onTenant(list, tenantField, tenant))
+	} : own;
+};
+//#endregion
+export { withCurrentTenant };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.46.5";
+var version = "0.46.7";
 //#endregion
 export { version };

package/dist/read-scope.js

@@ -0,0 +1,65 @@
+import { andFilters, ownScope, requestAccess, trusted } from "./request-access.js";
+import { checkFilter, where } from "@protobase/schema";
+//#region src/read-scope.ts
+const sameTenant = (a, b) => String(a) === String(b);
+const memberSession = (session, membership) => ({
+	...session,
+	user: {
+		...session.user,
+		roles: membership.roles
+	},
+	tenant: membership.tenant,
+	...session.organization && { organization: { id: membership.tenant } }
+});
+const listsAsMuch = (own, other) => other.resolved.operations.list && Object.keys(own.model.fields).every((name) => Object.hasOwn(other.model.fields, name));
+const otherTenants = async (access) => {
+	const { deps, entry, session } = access;
+	const own = session.tenant;
+	if (!access.model.tenantAcross || own === void 0 || !session.memberships) return [];
+	const memberships = new Map((await session.memberships()).filter((membership) => !sameTenant(membership.tenant, own)).map((membership) => [String(membership.tenant), membership]));
+	return (await Promise.all([...memberships.values()].map(async (membership) => {
+		const other = await requestAccess(deps, entry, memberSession(session, membership));
+		return listsAsMuch(access, other) ? [{
+			tenant: membership.tenant,
+			rowFilter: other.resolved.rowFilter.read
+		}] : [];
+	}))).flat();
+};
+const acrossFilter = (full, reads) => {
+	if (reads.every((read) => read.rowFilter === void 0)) return void 0;
+	const tenantIs = (value) => {
+		const checked = checkFilter(trusted(full), where.eq(full.tenant, value));
+		if (!checked.ok) throw new Error(`The tenant ${value} of "${full.name}" does not make a filter: ${checked.errors[0].message}`);
+		return checked.filter;
+	};
+	return {
+		kind: "or",
+		args: reads.map((read) => andFilters([tenantIs(read.tenant), read.rowFilter])),
+		span: {
+			start: 0,
+			end: 0
+		}
+	};
+};
+/**
+* The query-layer scope of a list-style read (a list, its counts, facets, charts and map, and the labels and photos it
+* brings): the caller's own tenant, or for a resource whose lists read across tenants (`tenantAcross`) also every other
+* tenant the person is a member of, each with the row filter of their access there.
+*/
+const readScope = async (access, fullModel = access.full) => {
+	const own = ownScope(access, fullModel);
+	const others = await otherTenants(access);
+	if (others.length === 0) return own;
+	const reads = [{
+		tenant: own.tenantValue,
+		rowFilter: own.rowFilter
+	}, ...others];
+	const rowFilter = acrossFilter(fullModel, reads);
+	return {
+		tenantValues: reads.map((read) => read.tenant),
+		...rowFilter && { rowFilter },
+		fullModel
+	};
+};
+//#endregion
+export { readScope };

package/dist/related-labels.js

@@ -1,6 +1,7 @@
 import { badRequest } from "./problem.js";
-import { readScope, requestAccess } from "./request-access.js";
+import { requestAccess } from "./request-access.js";
 import { exposeRow } from "./rows.js";
+import { readScope } from "./read-scope.js";
 import { checkFilter, createWhere } from "@protobase/schema";
 import { listQuery } from "@protobase/query";
 //#region src/related-labels.ts
@@ -61,7 +62,7 @@ const namesOf = async (trx, { field, access }, keys) => {
 		filter: filter.filter,
 		columns: [key, field],
 		limit: keys.length
-	}, readScope(access))).rows.map((row) => exposeRow(model, row)).filter((row) => row[field] !== null && row[field] !== void 0);
+	}, await readScope(access))).rows.map((row) => exposeRow(model, row)).filter((row) => row[field] !== null && row[field] !== void 0);
 	return Object.fromEntries(named.map((row) => [String(row[key]), String(row[field])]));
 };
 /** The names of the records the rows' relations point at, one query per requested relation. */

package/dist/request-access.js

@@ -125,8 +125,8 @@ const andFilters = (filters) => {
 };
 /** The row filter that narrows which rows an operation may target: the read filter, plus the operation's own. */
 const targetFilter = (access, operation) => operation === "read" ? access.resolved.rowFilter.read : andFilters([access.resolved.rowFilter.read, access.resolved.rowFilter[operation]]);
-/** The query-layer scope for reads: tenant, the access row filter against the full model, soft delete from the full model. */
-const readScope = (access, fullModel = access.full) => {
+/** The query-layer scope of the caller's own tenant: it, the access row filter against the full model, soft delete from the full model. */
+const ownScope = (access, fullModel = access.full) => {
 	const tenant = tenantScope(access.entry, access.session);
 	const rowFilter = access.resolved.rowFilter.read;
 	return {
@@ -173,4 +173,4 @@ const recordDecision = async (access, operation, record, input) => {
 	return asFilter(access, result, operation);
 };
 //#endregion
-export { andFilters, readScope, recordDecision, requestAccess, requireOperation, targetFilter, visibleFields, writableFields, writeOnlyFields };
+export { andFilters, ownScope, recordDecision, requestAccess, requireOperation, targetFilter, trusted, visibleFields, writableFields, writeOnlyFields };

package/dist/row-permissions.js

@@ -20,17 +20,25 @@ const matching = async (trx, access, rows, filter) => {
 	const found = await sql`select ${sql.join(keyFields.map(aliasedColumn))} from ${tableId(full)} as t${whereClause(conditions)}`.execute(trx);
 	return new Set(found.rows.map((row) => keyOf(access, row)));
 };
+const elsewhere = (access, row) => {
+	const tenant = access.full.tenant;
+	return access.model.tenantAcross !== void 0 && tenant !== void 0 && String(row[tenant]) !== String(access.session.tenant);
+};
 /**
-* What the caller may do with each of these (exposed) rows: the operation must be allowed, the row must match the
-* operation's row filter (checked in the database), a record-level rule must pass for the stored record, and its parents
-* (`.parent()`) must allow writing it. This only informs the UI; every write is checked again by the write pipeline.
+* What the caller may do with each of these (exposed) rows: the row must be of the caller's tenant, the operation must
+* be allowed, the row must match the operation's row filter (checked in the database), a record-level rule must pass
+* for the stored record, and its parents (`.parent()`) must allow writing it. This only informs the UI; every write is
+* checked again by the write pipeline.
 */
 const rowPermissions = async (trx, access, rows) => {
 	const { resolved, entry, session } = access;
-	const result = rows.map(() => ({
+	const result = rows.map((row) => elsewhere(access, row) ? {
+		update: false,
+		delete: false
+	} : {
 		update: true,
 		delete: true
-	}));
+	});
 	if (rows.length === 0) return result;
 	for (const operation of ["update", "delete"]) {
 		if (!resolved.operations[operation]) {

package/dist/types.d.ts

@@ -13,11 +13,22 @@ export type User = {
 export type SessionOrganization = {
   id: TenantValue;
 };
+/** A tenant the person is a member of, with the roles they act with there. */
+export type Membership = {
+  tenant: TenantValue;
+  roles: string[];
+};
 /** `anonymous` marks a request without a token, served as the project's `anonymous` role. */
 export type Session = {
   user: User;
   tenant?: TenantValue;
   organization?: SessionOrganization;
+  /**
+   * The tenants the person is a member of, each with the roles they act with there, read when a list of a resource
+   * with `.tenant(pick, { across: 'memberships' })` needs them. An authenticator sets it only when it knows them; without
+   * it, such lists read `tenant` alone. It must never answer a tenant the person is not a member of.
+   */
+  memberships?: () => Promise<Membership[]>;
   anonymous?: true;
   /** The outside app acting as the user, such as an MCP client: its OAuth client id and the scopes its token carries. */
   client?: {

package/dist/view-access.js

@@ -308,6 +308,7 @@ const viewShape = (resource, model, models, prompted, createPages, writeOnly) =>
 		hidden: shapes.data,
 		group: shapes.data,
 		order: shapes.data,
+		tenant: shapes.data,
 		recent: shapes.map((recent) => navRecentErrors(recent, model).length === 0 ? recent : void 0)
 	});
 	const chart = shapes.map((chart) => chartFields(chart).every((name) => Object.hasOwn(model.fields, name)) ? chart : void 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.46.5",
+  "version": "0.46.7",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.46.5",
-    "@protobase/query": "0.46.5",
-    "@protobase/schema": "0.46.5",
+    "@protobase/layout": "0.46.7",
+    "@protobase/query": "0.46.7",
+    "@protobase/schema": "0.46.7",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",