@protobase/server 0.63.1 → 0.63.2

package/dist/better-auth/organizations/session-organization.js

@@ -37,21 +37,28 @@ const organizationClaims = async (adapter, user, activeOrganizationId) => {
 	return {};
 };
 /**
+* The organization a new session of `user` starts in (`initialOrganization`): the one they last worked in while they
+* may still enter it, else their oldest membership, else none.
+*/
+const startingOrganization = async (adapter, user) => {
+	const last = user.lastOrganizationId;
+	return initialOrganization({
+		memberships: summaries(await membershipsOf(adapter, user.id)),
+		last,
+		entersAny: globalRoles(user.role).length > 0,
+		lastExists: Boolean(last) && await findOrganization(adapter, last) !== null
+	});
+};
+/**
 * Better Auth's session hooks for organizations: a new session starts in the organization the person last worked in
-* (`initialOrganization`), and a session's change of organization is kept on the user as the next one's start.
+* (`startingOrganization`), and a session's change of organization is kept on the user as the next one's start.
 */
 const sessionOrganizationHooks = (context) => ({
 	create: { before: async (session) => {
 		const { adapter, internalAdapter } = await context();
 		const user = await internalAdapter.findUserById(session.userId);
 		if (!user) return;
-		const last = user.lastOrganizationId;
-		const activeOrganizationId = initialOrganization({
-			memberships: summaries(await membershipsOf(adapter, user.id)),
-			last,
-			entersAny: globalRoles(user.role).length > 0,
-			lastExists: Boolean(last) && await findOrganization(adapter, last) !== null
-		});
+		const activeOrganizationId = await startingOrganization(adapter, user);
 		return activeOrganizationId ? { data: {
 			...session,
 			activeOrganizationId
@@ -65,4 +72,4 @@ const sessionOrganizationHooks = (context) => ({
 	} }
 });
 //#endregion
-export { lastOrganizationField, mayEnter, organizationClaims, sessionOrganizationHooks };
+export { lastOrganizationField, mayEnter, organizationClaims, sessionOrganizationHooks, startingOrganization };

package/dist/better-auth/tokens.d.ts

@@ -4,12 +4,18 @@ export type IssueTokenOptions = {
   email: string;
   /** Lifetime in seconds. Default 15 minutes, at most 24 hours. */
   ttlSeconds?: number;
+  /**
+   * With organizations, the organization the token works in, by id or slug; refused unless the person may work in it.
+   * Default: the one a new session of theirs would start in.
+   */
+  organization?: string;
 };
 export declare const maxTokenTtlSeconds: number;
 /**
- * Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims
- * (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session. It carries
- * the role the user last chose, else their first.
+ * Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims as
+ * `/api/auth/token` for a new session of theirs (see `tokenClaims`), so the API accepts it like a token from a browser
+ * session. It carries the role the user last chose, else their first; with organizations, the claims of
+ * `options.organization`, else of the organization a new session would start in.
  * Host side only: there is no HTTP route for this.
  */
 export declare const issueToken: (auth: AdminAuth, options: IssueTokenOptions) => Promise<{

package/dist/better-auth/tokens.js

@@ -1,17 +1,26 @@
-import { parseRoles } from "./parse-roles.js";
-import { narrowClaims } from "./roles/active-role.js";
+import { mayEnter, startingOrganization } from "./organizations/session-organization.js";
+import { tokenClaims } from "./token-claims.js";
+import { findOrganizationByKey } from "./organizations/host.js";
 //#region src/better-auth/tokens.ts
 const defaultTtlSeconds = 900;
 const maxTokenTtlSeconds = 86400;
+const organizationOf = async (auth, adapter, user, organization) => {
+	if (organization === void 0) return startingOrganization(adapter, user);
+	const found = await findOrganizationByKey(auth, organization);
+	if (!await mayEnter(adapter, user, found.id)) throw new Error(`${user.email} may not work in organization "${organization}"`);
+	return found.id;
+};
 /**
-* Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims
-* (`sub`, `email`, `role`) as `/api/auth/token`, so the API accepts it like a token from a browser session. It carries
-* the role the user last chose, else their first.
+* Mints a bearer token for an existing user: signed with the JWT plugin's keys, same issuer, audience and claims as
+* `/api/auth/token` for a new session of theirs (see `tokenClaims`), so the API accepts it like a token from a browser
+* session. It carries the role the user last chose, else their first; with organizations, the claims of
+* `options.organization`, else of the organization a new session would start in.
 * Host side only: there is no HTTP route for this.
 */
 const issueToken = async (auth, options) => {
 	const ttl = options.ttlSeconds ?? defaultTtlSeconds;
 	if (!Number.isInteger(ttl) || ttl < 1 || ttl > 86400) throw new Error(`Token lifetime must be between 1 second and ${maxTokenTtlSeconds} seconds (24 hours)`);
+	if (options.organization !== void 0 && !auth.organizations) throw new Error("Organizations are off: a token cannot name an organization");
 	const { adapter } = await auth.$context;
 	const user = await adapter.findOne({
 		model: "user",
@@ -22,15 +31,19 @@ const issueToken = async (auth, options) => {
 	});
 	if (!user) throw new Error(`No user with email ${options.email}`);
 	if (user.banned) throw new Error(`${options.email} is banned`);
+	const organizationId = auth.organizations ? await organizationOf(auth, adapter, user, options.organization) : void 0;
+	const claims = await tokenClaims(user, {
+		wanted: [user.lastRole],
+		organizationId,
+		...auth.organizations && { organizations: adapter }
+	});
 	const issuedAt = Math.floor(Date.now() / 1e3);
-	const { role } = narrowClaims({ role: parseRoles(user.role).join(",") }, [user.lastRole], Boolean(auth.organizations));
 	await auth.api.ensureSigningKey();
 	const { token } = await auth.api.signJWT({ body: { payload: {
 		iat: issuedAt,
 		exp: issuedAt + ttl,
 		sub: user.id,
-		email: user.email,
-		role
+		...claims
 	} } });
 	return {
 		token,

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.63.1";
+var version = "0.63.2";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.63.1",
+  "version": "0.63.2",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -42,9 +42,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.63.1",
-    "@protobase/query": "0.63.1",
-    "@protobase/schema": "0.63.1",
+    "@protobase/layout": "0.63.2",
+    "@protobase/query": "0.63.2",
+    "@protobase/schema": "0.63.2",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",