@protobase/server 0.67.5 → 0.67.6

package/dist/better-auth/authenticator.js

@@ -47,11 +47,18 @@ const betterAuthAuthenticator = (options) => {
 		const verify = async (request) => {
 			const { payload, session } = await sessions(request);
 			if (!auth) return session;
-			const signIn = await standing(await auth.$context, payload, session);
-			return signIn ? {
+			const { signIn, organizationRole } = await standing(await auth.$context, payload, session);
+			const withRole = organizationRole && session.tenant !== void 0 ? {
 				...session,
-				signIn
+				organization: {
+					id: session.tenant,
+					role: organizationRole
+				}
 			} : session;
+			return signIn ? {
+				...withRole,
+				signIn
+			} : withRole;
 		};
 		if (!organizations) return verify;
 		return async (request) => {
@@ -65,7 +72,10 @@ const betterAuthAuthenticator = (options) => {
 			return {
 				...session,
 				user,
-				...session.tenant !== void 0 && { organization: { id: session.tenant } },
+				...session.tenant !== void 0 && { organization: {
+					id: session.tenant,
+					...session.organization?.role && { role: session.organization.role }
+				} },
 				...across
 			};
 		};
@@ -81,7 +91,8 @@ const betterAuthAuthenticator = (options) => {
 			issuedAt: payload.iat
 		});
 		const { sessionId: _, ...claims } = tokenClaims(payload, session.user.roles, organizations ? session.tenant : void 0);
-		await checkUserStanding(context, claims, organizations);
+		const organizationRole = await checkUserStanding(context, claims, organizations);
+		return organizationRole ? { organizationRole } : {};
 	};
 	return Object.assign(withTrustedApps(own, issuer, options.apps ?? []), { forAudience: (audience) => sessionOf({
 		audience,

package/dist/better-auth/token-standing.js

@@ -2,7 +2,7 @@ import { unauthorized } from "../problem.js";
 import { noGlobalRole } from "./organizations/role-definitions.js";
 import { parseRoles } from "./parse-roles.js";
 import { effectiveRoles, globalRoles } from "./organizations/app-roles.js";
-import { findMember, findOrganization } from "./organizations/store.js";
+import { findMember, findOrganization, organizationRoleOf } from "./organizations/store.js";
 import { isStaffSession } from "./staff-checks.js";
 import { strongSignInAt } from "./strong-sign-ins.js";
 //#region src/better-auth/token-standing.ts
@@ -23,20 +23,24 @@ const tokenClaims = (payload, roles, tenant) => ({
 const revoked = () => unauthorized("The bearer token was revoked: get a new one");
 const bannedNow = (user, now) => Boolean(user.banned) && (!user.banExpires || user.banExpires > now);
 const heldWhere = async ({ adapter }, user, organizations, organizationId) => {
-	if (!organizations) return parseRoles(user.role);
+	if (!organizations) return { roles: parseRoles(user.role) };
 	const global = globalRoles(user.role);
-	if (!organizationId) return global;
+	if (!organizationId) return { roles: global };
 	const member = await findMember(adapter, {
 		organizationId,
 		userId: user.id
 	});
-	if (member) return effectiveRoles(global, member.appRoles);
-	return global.length > 0 && await findOrganization(adapter, organizationId) !== null ? global : void 0;
+	if (member) return {
+		roles: effectiveRoles(global, member.appRoles),
+		organizationRole: organizationRoleOf(member)
+	};
+	return global.length > 0 && await findOrganization(adapter, organizationId) !== null ? { roles: global } : void 0;
 };
 /**
 * Whether a token's user still stands, read from the store: they exist and are not banned, and each role the token
 * carries is one they still hold where it works. The part of `checkTokenStanding` an MCP access token gets, whose
-* grant outlives the browser session that made it.
+* grant outlives the browser session that made it. Answers their organization role where the token works, as the
+* store holds it now, `undefined` for someone who is no member there.
 */
 const checkUserStanding = async (context, claims, organizations, now = /* @__PURE__ */ new Date()) => {
 	const user = await context.adapter.findOne({
@@ -48,14 +52,16 @@ const checkUserStanding = async (context, claims, organizations, now = /* @__PUR
 	});
 	if (!user || bannedNow(user, now)) throw revoked();
 	const held = await heldWhere(context, user, organizations, claims.organizationId);
-	if (!held || claims.roles.some((role) => !held.includes(role))) throw revoked();
+	if (!held || claims.roles.some((role) => !held.roles.includes(role))) throw revoked();
+	return held.organizationRole;
 };
 /**
 * Whether a token still stands, read from the store on every request: its session is not signed out or expired, and
 * its user still stands (`checkUserStanding`). A token that fails is a 401, so the client asks its session for a new
 * one, which carries the roles as they are now or is refused. Answers the sign-in the token's session stands for
 * (`signInOf`), `undefined` for a token without one; the user's own one also reads, when asked, when it last proved a
-* passkey or a second step (`strongSignInAt`).
+* passkey or a second step (`strongSignInAt`). Answers it with the user's organization role where the token works
+* (`checkUserStanding`).
 */
 const checkTokenStanding = async (context, claims, organizations, now = /* @__PURE__ */ new Date()) => {
 	const session = claims.sessionId === void 0 ? void 0 : await context.adapter.findOne({
@@ -66,12 +72,18 @@ const checkTokenStanding = async (context, claims, organizations, now = /* @__PU
 		}]
 	});
 	if (claims.sessionId !== void 0 && (!session || session.userId !== claims.userId || session.expiresAt <= now)) throw revoked();
-	await checkUserStanding(context, claims, organizations, now);
+	const organizationRole = await checkUserStanding(context, claims, organizations, now);
 	const signIn = session ? signInOf(session, claims.sessionId) : void 0;
-	if (!signIn || signIn.staff) return signIn;
+	if (!signIn || signIn.staff) return {
+		signIn,
+		...organizationRole && { organizationRole }
+	};
 	return {
-		...signIn,
-		strongAt: () => strongSignInAt(context.internalAdapter, claims.sessionId)
+		signIn: {
+			...signIn,
+			strongAt: () => strongSignInAt(context.internalAdapter, claims.sessionId)
+		},
+		...organizationRole && { organizationRole }
 	};
 };
 //#endregion

package/dist/create-admin.d.ts

@@ -27,8 +27,13 @@ import { UpgradeWebSocket } from "hono/ws";
 export type CreateAdminInput = {
   resources: ResourceSource[];
   views?: ViewSource[];
-  /** The tables users add, from their definitions (`userTableResources`): one a resource here or a built-in names is left out with a warning. */
-  userTables?: UserTableSources;
+  /**
+   * The tables users add, from their definitions (`userTableResources`): one a resource here or a built-in names is left
+   * out with a warning. `organizations`, by default whether `auth` has them, keeps each definition in its organization.
+   */
+  userTables?: UserTableSources & {
+    organizations?: boolean;
+  };
   /** The `userMenu(...)` export of the config module: pages under the signed-in user in the sidebar. */
   userMenu?: UserMenuSource;
   /** The `bottomBar(...)` exports of the config module, in order: tabs on phones for the roles each names. */

package/dist/create-admin.js

@@ -138,7 +138,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 		notifications: notifications !== void 0,
 		...events && { events }
 	});
-	const served = adminUserTables(userTables, [...appModels, ...builtIn.resources.map((resource) => resource.toModel())].map((model) => model.name), options.roles !== void 0);
+	const served = adminUserTables(userTables, [...appModels, ...builtIn.resources.map((resource) => resource.toModel())].map((model) => model.name), options.roles !== void 0, userTables?.organizations ?? Boolean(auth?.organizations));
 	for (const warning of served.warnings) console.warn(warning);
 	const resources = [
 		...appResources,

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.67.5";
+var version = "0.67.6";
 //#endregion
 export { version };

package/dist/types.d.ts

@@ -11,9 +11,13 @@ export type User = {
   id: string | number;
   roles: string[];
 };
-/** The organization a request works in, with organizations on: the same value as `tenant`. */
+/**
+ * The organization a request works in, with organizations on: the same value as `tenant`, and the caller's organization
+ * role there, read from the store for this request; absent for someone who is no member there.
+ */
 export type SessionOrganization = {
   id: TenantValue;
+  role?: 'owner' | 'admin' | 'member';
 };
 /** A tenant the person is a member of, with the roles they act with there. */
 export type Membership = {

package/dist/user-tables/admin-user-tables.js

@@ -5,9 +5,10 @@ import { servedUserTables } from "./served-user-tables.js";
 /**
 * What the tables users add bring to the admin, with `userTables` on: the resources over their definitions, through
 * which they are created, each user table a name in code (`codeNames`, the app's and Protobase's) does not take, and the
-* hook that creates their tables and columns. Without `tables`, nothing.
+* hook that creates their tables and columns. Without `tables`, nothing. With `organizations`, each definition belongs
+* to the organization it was made in (`definitionsResources`).
 */
-const adminUserTables = (tables, codeNames, roles) => {
+const adminUserTables = (tables, codeNames, roles, organizations = false) => {
 	if (!tables) return {
 		resources: [],
 		views: [],
@@ -16,7 +17,8 @@ const adminUserTables = (tables, codeNames, roles) => {
 	};
 	const definitions = definitionsResources({
 		roles,
-		taken: codeNames
+		taken: codeNames,
+		organizations
 	});
 	const served = servedUserTables(tables, [
 		...codeNames,

package/dist/user-tables/check-definition.js

@@ -1,10 +1,10 @@
-import { definitionColumnTypes, definitionFieldTypes, isUserTableName, userTablesSchema } from "./names.js";
+import { definitionColumnTypes, definitionFieldTypes, isUserTableName, organizationColumn, userTablesSchema } from "./names.js";
 //#region src/user-tables/check-definition.ts
 const reservedFields = ["id", "etag"];
 const isFieldType = (type) => definitionFieldTypes.includes(type);
-const fieldProblem = (field, columns) => {
+const fieldProblem = (field, columns, organization) => {
 	if (!isUserTableName(field.name)) return `the field name ${JSON.stringify(field.name)} is not lowercase letters, digits and "_", starting with a letter, at most 63 bytes`;
-	if (reservedFields.includes(field.name)) return `the field name "${field.name}" is reserved`;
+	if (reservedFields.includes(field.name) || organization && field.name === "organization_id") return `the field name "${field.name}" is reserved`;
 	if (!isFieldType(field.type)) return `the field "${field.name}" has the type ${JSON.stringify(field.type)}, which is not one of ${definitionFieldTypes.join(", ")}`;
 	if (field.type === "decimal" && (field.precision === null || field.scale === null)) return `the decimal field "${field.name}" has no precision and scale`;
 	const column = columns.get(field.name);
@@ -15,7 +15,8 @@ const fieldProblem = (field, columns) => {
 /**
 * The definition checked against the user tables schema, or the first thing wrong with it: every name a safe
 * identifier, every type one of the eight, its table there with an `id bigint` primary key and a column of the right
-* type for each field, and its title a text field of it.
+* type for each field, and its title a text field of it. An organization's table also has its `organization_id text
+* not null` column, which `.tenant` scopes its records by.
 */
 const checkDefinition = (definition, tables) => {
 	const problem = (text) => ({ problem: `The user table ${JSON.stringify(definition.name)} is not served: ${text}.` });
@@ -24,11 +25,14 @@ const checkDefinition = (definition, tables) => {
 	if (!columns) return problem(`the table ${userTablesSchema}.${definition.name} does not exist`);
 	const id = columns.get("id");
 	if (!id || id.type !== "bigint" || !id.key) return problem(`${userTablesSchema}.${definition.name} has no "id" bigint primary key`);
+	const organization = definition.organization_id !== null;
+	const tenant = columns.get(organizationColumn);
+	if (organization && (!tenant || tenant.type !== "text" || !tenant.notNull)) return problem(`${userTablesSchema}.${definition.name} has no "${organizationColumn}" text NOT NULL column for its organization`);
 	const seen = /* @__PURE__ */ new Set();
 	for (const field of definition.fields) {
 		if (seen.has(field.name)) return problem(`the field "${field.name}" is defined twice`);
 		seen.add(field.name);
-		const found = fieldProblem(field, columns);
+		const found = fieldProblem(field, columns, organization);
 		if (found) return problem(found);
 	}
 	const title = definition.fields.find((field) => field.name === definition.title_field);

package/dist/user-tables/definition-resource.d.ts

@@ -6,6 +6,7 @@ export declare const maxTextLength = 500;
 /**
  * The resource and view of a checked definition over `user_tables.<name>`, with the indexes its table has (none before
  * they are read): built with the schema builders, so it is checked, accessed and guarded as a resource of the config.
+ * An organization's table is a `.tenant` resource over its `organization_id`.
  */
 export declare const definitionResource: (definition: CheckedDefinition, indexes?: TableIndexes) => {
   resource: import("@protobase/schema").ResourceBuilder<any, import("@protobase/schema").Ref<string, unknown>>;

package/dist/user-tables/definition-resource.js

@@ -1,4 +1,5 @@
-import { userTablesSchema } from "./names.js";
+import { organizationColumn, userTablesSchema } from "./names.js";
+import { organizationAdminsOf } from "./organization-access.js";
 import { f, resource, view } from "@protobase/schema";
 import { indexServes } from "@protobase/query";
 //#region src/user-tables/definition-resource.ts
@@ -31,6 +32,7 @@ const fieldOf = (field, indexes) => {
 /**
 * The resource and view of a checked definition over `user_tables.<name>`, with the indexes its table has (none before
 * they are read): built with the schema builders, so it is checked, accessed and guarded as a resource of the config.
+* An organization's table is a `.tenant` resource over its `organization_id`.
 */
 const definitionResource = (definition, indexes = {
 	kind: "table",
@@ -38,15 +40,22 @@ const definitionResource = (definition, indexes = {
 }) => {
 	const key = f.bigint().readOnly().dbDefault();
 	const keyed = served(indexes, "id", "btree") ? key.filterable().sortable() : key;
-	const fields = Object.fromEntries([["id", keyed], ...definition.fields.map((field) => [field.name, fieldOf(field, indexes)])]);
+	const organization = definition.organization_id === null ? [] : [[organizationColumn, f.text()]];
+	const fields = Object.fromEntries([
+		["id", keyed],
+		...organization,
+		...definition.fields.map((field) => [field.name, fieldOf(field, indexes)])
+	]);
 	const title = definition.fields.find((field) => field.name === definition.title_field);
-	const base = resource(definition.name).table(`${userTablesSchema}.${definition.name}`).fields(fields).primaryKey((r) => r.id).explicitGrants().access({
-		list: admins,
-		read: admins,
-		create: admins,
-		update: admins,
-		delete: admins
+	const who = definition.organization_id === null ? admins : organizationAdminsOf(definition.organization_id);
+	const accessed = resource(definition.name).table(`${userTablesSchema}.${definition.name}`).fields(fields).primaryKey((r) => r.id).explicitGrants().access({
+		list: who,
+		read: who,
+		create: who,
+		update: who,
+		delete: who
 	});
+	const base = definition.organization_id === null ? accessed : accessed.tenant((r) => r[organizationColumn]);
 	const searchable = title && served(indexes, title.name, "trigram") ? base.search((r) => [r[title.name]]) : base;
 	const labelled = view(definition.name).names({
 		singular: definition.singular_label,

package/dist/user-tables/definitions-hook.js

@@ -4,7 +4,7 @@ import { checkDefinition } from "./check-definition.js";
 import { definitionResource } from "./definition-resource.js";
 import "./definitions-resources.js";
 import { readDefinitions, readUserTableColumns } from "./read-definitions.js";
-import { createTableSql, fieldSql, trigramIndexSql } from "./table-ddl.js";
+import { createOrganizationTableSql, createTableSql, fieldSql, trigramIndexSql } from "./table-ddl.js";
 import { indexServes, tableIndexes } from "@protobase/query";
 import { sql } from "kysely";
 //#region src/user-tables/definitions-hook.ts
@@ -15,8 +15,9 @@ const refuse = (field, message) => badRequest("invalid-record", `The request bod
 }] });
 const tablesTable = sql.table(`${definitionsSchema}.tables`);
 const raiseVersion = (trx, tableId) => sql`update ${tablesTable} set version = version + 1 where id = ${tableId}`.execute(trx);
-const lockedTable = async (trx, tableId) => {
-	const { rows } = await sql`select name, title_field from ${tablesTable} where id = ${tableId} for update`.execute(trx);
+const lockedTable = async (trx, tableId, organizationId) => {
+	const { rows } = await sql`select table_name as name from ${tablesTable} where id = ${tableId} and tenant_key = coalesce(${organizationId ?? null}::text, '-') for update`.execute(trx);
+	if (!rows[0]) throw refuse("table_id", "There is no such table");
 	return rows[0];
 };
 const builtDefinition = async (trx, tableId) => {
@@ -33,13 +34,14 @@ const builtDefinition = async (trx, tableId) => {
 };
 const createTable = async (trx, table) => {
 	if (table.title_field != null) throw refuse("title_field", "Set the title field once its field is added");
-	const { rows } = await sql`select to_regclass(format('%I.%I', ${userTablesSchema}::text, ${table.name}::text)) is not null as found`.execute(trx);
-	if (rows[0].found) throw refuse("name", `The database already has a table "${table.name}" for the tables users add`);
-	await createTableSql(table.name).execute(trx);
+	const { rows } = await sql`select to_regclass(format('%I.%I', ${userTablesSchema}::text, ${table.table_name}::text)) is not null as found`.execute(trx);
+	if (rows[0].found) throw refuse("name", `The database already has a table "${table.table_name}" for the tables users add`);
+	const statements = table.organization_id == null ? [createTableSql(table.table_name)] : createOrganizationTableSql(table.table_name);
+	for (const statement of statements) await statement.execute(trx);
 	await builtDefinition(trx, table.id);
 };
 const addField = async (trx, field, taken) => {
-	const table = await lockedTable(trx, field.table_id);
+	const table = await lockedTable(trx, field.table_id, field.organization_id);
 	if (taken.includes(table.name)) throw refuse("table_id", `"${table.name}" is a resource in the app's code now, which owns its fields`);
 	const { rows } = await sql`select exists (select from pg_attribute a join pg_class c on c.oid = a.attrelid join pg_namespace n on n.oid = c.relnamespace
     where n.nspname = ${userTablesSchema} and c.relname = ${table.name} and a.attname = ${field.name} and a.attnum > 0 and not a.attisdropped) as found`.execute(trx);

package/dist/user-tables/definitions-resources.js

@@ -1,4 +1,5 @@
-import { definitionFieldTypes, definitionsSchema, nameProblem } from "./names.js";
+import { definitionFieldTypes, definitionsSchema, nameProblem, organizationColumn } from "./names.js";
+import { organizationAdmins } from "./organization-access.js";
 import { f, resource } from "@protobase/schema";
 //#region src/user-tables/definitions-resources.ts
 /** The names of the resources over the definitions: a table users add takes neither. */
@@ -7,13 +8,20 @@ const fieldsResourceName = "user_table_fields";
 const admins = ({ user }) => user?.roles?.includes("admin") ?? false;
 const never = () => false;
 const createOnly = { update: never };
-const accessOf = (roles) => roles ? { delete: never } : {
+const accessOf = (roles, organizations) => organizations ? {
+	list: organizationAdmins,
+	read: organizationAdmins,
+	create: organizationAdmins,
+	update: organizationAdmins,
+	delete: never
+} : roles ? { delete: never } : {
 	list: admins,
 	read: admins,
 	create: admins,
 	update: admins,
 	delete: never
 };
+const withOrganization = (source, organizations) => organizations ? source.tenant((r) => r[organizationColumn]) : source;
 const issue = (field, problem) => problem ? [{
 	field,
 	message: problem
@@ -22,32 +30,43 @@ const issue = (field, problem) => problem ? [{
 * The definitions of the tables users add, as resources: a table at `/user_tables/<id>`, each of its fields at
 * `/user_table_fields/<table_id>,<name>`. Writing one creates its table or column in the database, in the same
 * transaction (`definitionsHook`). `taken` holds the names of the app's resources and those Protobase adds, which a
-* new table may not have.
+* new table may not have. With `organizations`, each belongs to the organization it was made in and only that one's
+* owners and admins reach it; its table is `t<id>_<name>` (`table_name`), so the name is free in every organization.
 */
-const definitionsResources = ({ roles, taken }) => {
+const definitionsResources = ({ roles, taken, organizations = false }) => {
+	const organization = organizations ? { [organizationColumn]: f.text() } : {};
+	const nameIssue = (name) => {
+		if (organizations) return nameProblem(name, "table", 42);
+		return nameProblem(name, "table") ?? (taken.includes(name) || ["user_tables", "user_table_fields"].includes(name) ? `"${name}" is the name of a resource of the app` : void 0);
+	};
+	const tables = resource(tablesResourceName).table(`${definitionsSchema}.tables`).fields({
+		id: f.bigint().readOnly().dbDefault().filterable().sortable(),
+		name: f.text().access(createOnly).filterable().sortable(),
+		singular_label: f.text().max(200),
+		plural_label: f.text().max(200),
+		title_field: f.text().optional(),
+		version: f.bigint().readOnly().dbDefault(),
+		table_name: f.text().readOnly().dbDefault(),
+		...organization
+	}).primaryKey((r) => r.id).explicitGrants().access(accessOf(roles, organizations)).validate((table) => [...issue("name", nameIssue(table.name)), ...issue("title_field", table.title_field ? nameProblem(table.title_field, "field") : void 0)]);
+	const fields = resource(fieldsResourceName).table(`${definitionsSchema}.fields`).fields({
+		table_id: f.relation(tablesResourceName).access(createOnly).filterable(),
+		name: f.text().access(createOnly),
+		label: f.text().max(200),
+		type: f.enum(definitionFieldTypes).access(createOnly),
+		required: f.boolean().default(false).access(createOnly),
+		position: f.integer().sortable(),
+		precision: f.integer().optional().access(createOnly),
+		scale: f.integer().optional().access(createOnly),
+		...organization
+	}).primaryKey((r) => [r.table_id, r.name]).explicitGrants().access(accessOf(roles, organizations)).validate((field) => [
+		...issue("name", nameProblem(field.name, "field")),
+		...issue("required", field.required ? "A field users add is optional: the records already there have no value for it" : void 0),
+		...field.type === "decimal" ? [...issue("precision", field.precision == null || field.precision < 1 || field.precision > 1e3 ? "A decimal needs a precision from 1 to 1000" : void 0), ...issue("scale", field.scale == null || field.scale < 0 || field.precision != null && field.scale > field.precision ? "A decimal needs a scale from 0 to its precision" : void 0)] : [...issue("precision", field.precision == null ? void 0 : "Only a decimal has a precision"), ...issue("scale", field.scale == null ? void 0 : "Only a decimal has a scale")]
+	]);
 	return {
-		tables: resource(tablesResourceName).table(`${definitionsSchema}.tables`).fields({
-			id: f.bigint().readOnly().dbDefault().filterable().sortable(),
-			name: f.text().access(createOnly).filterable().sortable(),
-			singular_label: f.text().max(200),
-			plural_label: f.text().max(200),
-			title_field: f.text().optional(),
-			version: f.bigint().readOnly().dbDefault()
-		}).primaryKey((r) => r.id).explicitGrants().access(accessOf(roles)).validate((table) => [...issue("name", nameProblem(table.name, "table") ?? (taken.includes(table.name) || ["user_tables", "user_table_fields"].includes(table.name) ? `"${table.name}" is the name of a resource of the app` : void 0)), ...issue("title_field", table.title_field ? nameProblem(table.title_field, "field") : void 0)]),
-		fields: resource(fieldsResourceName).table(`${definitionsSchema}.fields`).fields({
-			table_id: f.relation(tablesResourceName).access(createOnly).filterable(),
-			name: f.text().access(createOnly),
-			label: f.text().max(200),
-			type: f.enum(definitionFieldTypes).access(createOnly),
-			required: f.boolean().default(false).access(createOnly),
-			position: f.integer().sortable(),
-			precision: f.integer().optional().access(createOnly),
-			scale: f.integer().optional().access(createOnly)
-		}).primaryKey((r) => [r.table_id, r.name]).explicitGrants().access(accessOf(roles)).validate((field) => [
-			...issue("name", nameProblem(field.name, "field")),
-			...issue("required", field.required ? "A field users add is optional: the records already there have no value for it" : void 0),
-			...field.type === "decimal" ? [...issue("precision", field.precision == null || field.precision < 1 || field.precision > 1e3 ? "A decimal needs a precision from 1 to 1000" : void 0), ...issue("scale", field.scale == null || field.scale < 0 || field.precision != null && field.scale > field.precision ? "A decimal needs a scale from 0 to its precision" : void 0)] : [...issue("precision", field.precision == null ? void 0 : "Only a decimal has a precision"), ...issue("scale", field.scale == null ? void 0 : "Only a decimal has a scale")]
-		])
+		tables: withOrganization(tables, organizations),
+		fields: withOrganization(fields, organizations)
 	};
 };
 //#endregion

package/dist/user-tables/names.js

@@ -19,13 +19,19 @@ const definitionColumnTypes = {
 };
 const definitionFieldTypes = Object.keys(definitionColumnTypes);
 const isUserTableName = (name) => userTableName.test(name) && new TextEncoder().encode(name).length <= 63;
-/** The names a field never takes: the key's, and the API's for the record version. */
-const reservedFieldNames = ["id", "etag"];
-/** What is wrong with a name a table or field users add is given, or `undefined` when it may have it. */
-const nameProblem = (name, kind) => {
-	if (typeof name !== "string" || !isUserTableName(name)) return "Use lowercase letters, digits and \"_\", starting with a letter, at most 63 bytes";
+/** The column that holds the organization of each record of a table users add with organizations, and of each definition. */
+const organizationColumn = "organization_id";
+/** The names a field never takes: the key's, the API's for the record version, and the organization's. */
+const reservedFieldNames = [
+	"id",
+	"etag",
+	organizationColumn
+];
+/** What is wrong with a name a table or field users add is given, or `undefined` when it may have it; `maxBytes` defaults to 63. */
+const nameProblem = (name, kind, maxBytes = 63) => {
+	if (typeof name !== "string" || !isUserTableName(name) || new TextEncoder().encode(name).length > maxBytes) return `Use lowercase letters, digits and "_", starting with a letter, at most ${maxBytes} bytes`;
 	if (reservedWords.has(name)) return `"${name}" is a word SQL reserves`;
 	if (kind === "field" && reservedFieldNames.includes(name)) return `"${name}" is the name of a field every table has`;
 };
 //#endregion
-export { definitionColumnTypes, definitionFieldTypes, definitionsSchema, isUserTableName, nameProblem, reservedFieldNames, userTableName, userTablesSchema };
+export { definitionColumnTypes, definitionFieldTypes, definitionsSchema, isUserTableName, nameProblem, organizationColumn, reservedFieldNames, userTableName, userTablesSchema };

package/dist/user-tables/organization-access.js

@@ -0,0 +1,14 @@
+//#region src/user-tables/organization-access.ts
+/**
+* The organization's owners and admins, as the auth store holds their membership for this request, and superusers
+* working in it: no one without an organization, so a session that names none reaches nothing.
+*/
+const organizationAdmins = ({ user, organization }) => {
+	if (!organization) return false;
+	if (user?.roles?.includes("admin")) return true;
+	return organization.role === "owner" || organization.role === "admin";
+};
+/** `organizationAdmins` of the one organization `organizationId`, the one a table users add belongs to. */
+const organizationAdminsOf = (organizationId) => (context) => context.organization !== void 0 && String(context.organization.id) === organizationId && organizationAdmins(context);
+//#endregion
+export { organizationAdmins, organizationAdminsOf };

package/dist/user-tables/owned-definitions.d.ts

@@ -4,9 +4,10 @@ import { Db } from "@protobase/query";
 /** The user tables a resource in code owns, as `protobase eject` writes one: over `user_tables.<name>`, with that name. */
 export declare const ownedTableNames: (models: readonly ResourceModel[]) => string[];
 /**
- * The delete of the definitions of the user tables a resource in code owns, with their fields; their tables and rows
- * stay. `undefined` when no such definition is left. `protobase migration` writes it once the code that owns them has
- * deployed, so a definition goes in a later deploy than the one that stopped reading it.
+ * The delete of the definitions of the user tables a resource in code owns, with their fields, matched on the table
+ * they serve, so an organization's table of the same name stays; their tables and rows stay. `undefined` when no such
+ * definition is left. `protobase migration` writes it once the code that owns them has deployed, so a definition goes
+ * in a later deploy than the one that stopped reading it.
  */
 export declare const ownedDefinitionsMigration: (db: Db, models: readonly ResourceModel[]) => Promise<string | undefined>;
 //#endregion

package/dist/user-tables/owned-definitions.js

@@ -5,18 +5,19 @@ import { sql } from "kysely";
 const ownedTableNames = (models) => models.filter((model) => model.table.schema === "user_tables" && model.table.name === model.name).map((model) => model.name);
 const literal = (text) => `'${text.replaceAll("'", "''")}'`;
 /**
-* The delete of the definitions of the user tables a resource in code owns, with their fields; their tables and rows
-* stay. `undefined` when no such definition is left. `protobase migration` writes it once the code that owns them has
-* deployed, so a definition goes in a later deploy than the one that stopped reading it.
+* The delete of the definitions of the user tables a resource in code owns, with their fields, matched on the table
+* they serve, so an organization's table of the same name stays; their tables and rows stay. `undefined` when no such
+* definition is left. `protobase migration` writes it once the code that owns them has deployed, so a definition goes
+* in a later deploy than the one that stopped reading it.
 */
 const ownedDefinitionsMigration = async (db, models) => {
 	const owned = ownedTableNames(models);
 	if (owned.length === 0) return;
 	const { rows: found } = await sql`select to_regclass(${`${definitionsSchema}.tables`}) is not null as found`.execute(db);
 	if (!found[0].found) return;
-	const { rows } = await sql`select name from ${sql.table(`${definitionsSchema}.tables`)} where name = any(${owned}) order by name`.execute(db);
+	const { rows } = await sql`select table_name as name from ${sql.table(`${definitionsSchema}.tables`)} where table_name = any(${owned}) order by table_name`.execute(db);
 	if (rows.length === 0) return;
-	return `delete from ${definitionsSchema}.tables where name in (${rows.map((row) => literal(row.name)).join(", ")});`;
+	return `delete from ${definitionsSchema}.tables where table_name in (${rows.map((row) => literal(row.name)).join(", ")});`;
 };
 //#endregion
 export { ownedDefinitionsMigration, ownedTableNames };

package/dist/user-tables/read-definitions.d.ts

@@ -9,10 +9,15 @@ export type StoredField = {
   precision: number | null;
   scale: number | null;
 };
-/** A stored definition of a table users add, as its rows hold it, with its fields in order. */
+/**
+ * A stored definition of a table users add, as its rows hold it, with its fields in order. `name` is its table's name in
+ * the user tables schema and its resource's (`table_name`); `organization_id` the organization it belongs to, `null`
+ * without organizations.
+ */
 export type StoredDefinition = {
   id: string;
   name: string;
+  organization_id: string | null;
   singular_label: string;
   plural_label: string;
   title_field: string | null;

package/dist/user-tables/read-definitions.js

@@ -3,7 +3,7 @@ import { sql } from "kysely";
 //#region src/user-tables/read-definitions.ts
 /** The stored definitions, by id, each with its fields by position. */
 const readDefinitions = async (db) => {
-	const { rows } = await sql`select t.id::text as id, t.name, t.singular_label, t.plural_label, t.title_field, t.version::text as version,
+	const { rows } = await sql`select t.id::text as id, t.table_name as name, t.organization_id, t.singular_label, t.plural_label, t.title_field, t.version::text as version,
       coalesce((select json_agg(json_build_object('name', f.name, 'label', f.label, 'type', f.type, 'required', f.required, 'precision', f.precision, 'scale', f.scale) order by f.position, f.name)
         from ${sql.table(`${definitionsSchema}.fields`)} f where f.table_id = t.id), '[]') as fields
     from ${sql.table(`${definitionsSchema}.tables`)} t order by t.id`.execute(db);

package/dist/user-tables/schema-sql.js

@@ -1,20 +1,39 @@
 import { definitionFieldTypes, definitionsSchema, userTableName, userTablesSchema } from "./names.js";
 //#region src/user-tables/schema-sql.ts
 const nameCheck = (column) => `check (${column} ~ '${userTableName.source}' and octet_length(${column}) <= 63)`;
-/** The table of definitions: one row per table users add, its labels and a version, 1 when added, that each change of it raises. */
+/**
+* The table of definitions: one row per table users add, its labels and a version, 1 when added, that each change of it
+* raises. With organizations a definition belongs to the one it was made in (`organization_id`), and its table is named
+* `t<id>_<name>`, so two organizations can each have a table of one name; without, the table is the name. `table_name`
+* is the table's name in the user tables schema and the name of its resource.
+*/
 const tablesSql = () => `create table ${definitionsSchema}.tables (
   id bigint generated always as identity primary key,
-  name text not null unique ${nameCheck("name")},
+  name text not null ${nameCheck("name")},
+  organization_id text,
   singular_label text not null,
   plural_label text not null,
   title_field text ${nameCheck("title_field")},
-  version bigint not null default 1 check (version > 0)
+  version bigint not null default 1 check (version > 0),
+  ${tableNameColumn},
+  ${tenantKeyColumn},
+  unique (id, tenant_key)
 )`;
+const tableNameColumn = `table_name text not null unique generated always as (case when organization_id is null then name else 't' || id || '_' || name end) stored ${nameCheck("table_name")}`;
+const tenantKeyColumn = "tenant_key text not null generated always as (coalesce(organization_id, '-')) stored";
+/** A name is unique among the definitions of one organization, or of the app without organizations. */
+const nameIndexesSql = () => [`create unique index tables_name_key on ${definitionsSchema}.tables (name) where organization_id is null`, `create unique index tables_organization_name_key on ${definitionsSchema}.tables (organization_id, name) where organization_id is not null`];
 /** Gives a definitions table made before new definitions started at version 1 that default. */
 const versionDefaultSql = () => `alter table ${definitionsSchema}.tables alter column version set default 1`;
-/** The fields of each definition, in order, each with its label and type; a decimal names its precision and scale. */
+/**
+* The fields of each definition, in order, each with its label and type; a decimal names its precision and scale. A
+* field belongs to its table's organization: the foreign key compares both, so no field reaches another organization's
+* table, or one of none.
+*/
 const fieldsSql = () => `create table ${definitionsSchema}.fields (
-  table_id bigint not null references ${definitionsSchema}.tables (id) on delete cascade,
+  table_id bigint not null,
+  organization_id text,
+  ${tenantKeyColumn},
   name text not null ${nameCheck("name")} check (name not in ('id', 'etag')),
   label text not null,
   type text not null check (type in (${definitionFieldTypes.map((type) => `'${type}'`).join(", ")})),
@@ -23,8 +42,20 @@ const fieldsSql = () => `create table ${definitionsSchema}.fields (
   precision integer check (precision between 1 and 1000),
   scale integer check (scale between 0 and precision),
   primary key (table_id, name),
+  foreign key (table_id, tenant_key) references ${definitionsSchema}.tables (id, tenant_key) on delete cascade,
   check ((type = 'decimal') = (precision is not null and scale is not null))
 )`;
+/**
+* Brings a definitions table made before organizations to the shape of `tablesSql`: a name unique per organization and
+* the served name.
+*/
+const organizationsSql = () => [
+	`alter table ${definitionsSchema}.tables add column organization_id text, add column ${tableNameColumn}, add column ${tenantKeyColumn}, add unique (id, tenant_key)`,
+	`alter table ${definitionsSchema}.tables drop constraint tables_name_key`,
+	...nameIndexesSql()
+];
+/** Ties the fields made before organizations to their table's organization, as `fieldsSql` does. */
+const fieldsOrganizationSql = () => `alter table ${definitionsSchema}.fields add column organization_id text, add column ${tenantKeyColumn}, add foreign key (table_id, tenant_key) references ${definitionsSchema}.tables (id, tenant_key) on delete cascade`;
 const schemasSql = () => [
 	"create extension if not exists pg_trgm",
 	`create schema if not exists ${definitionsSchema}`,
@@ -34,4 +65,4 @@ const schemasSql = () => [
 	`grant usage, create on schema ${userTablesSchema} to current_user`
 ];
 //#endregion
-export { fieldsSql, schemasSql, tablesSql, versionDefaultSql };
+export { fieldsOrganizationSql, fieldsSql, nameIndexesSql, organizationsSql, schemasSql, tablesSql, versionDefaultSql };

package/dist/user-tables/schema.d.ts

@@ -2,7 +2,8 @@ import { Db } from "@protobase/query";
 //#region src/user-tables/schema.d.ts
 /**
  * The SQL that adds what user tables need: pg_trgm, the definitions schema with its `tables` and `fields`, and the
- * schema the tables themselves live in. `undefined` when current. Nothing is dropped.
+ * schema the tables themselves live in. `undefined` when current. Nothing is dropped but the unique constraint on a
+ * definition's name, which a name unique per organization replaces.
  */
 export declare const userTablesMigration: (db: Db) => Promise<string | undefined>;
 /** Refuses to go on while the schemas of user tables are missing; the project's migrations add them. */

package/dist/user-tables/schema.js

@@ -1,12 +1,14 @@
 import { migrationCommand } from "../changes/capture-schema.js";
 import { definitionsSchema, userTablesSchema } from "./names.js";
-import { fieldsSql, schemasSql, tablesSql, versionDefaultSql } from "./schema-sql.js";
+import { fieldsOrganizationSql, fieldsSql, nameIndexesSql, organizationsSql, schemasSql, tablesSql, versionDefaultSql } from "./schema-sql.js";
 import { sql } from "kysely";
 //#region src/user-tables/schema.ts
+const current = (found) => found.tables && found.versionDefault && found.organizations && found.fields && found.data && found.trgm;
 const readUserTablesSchema = async (db) => {
 	const { rows } = await sql`select
     to_regclass(${`${definitionsSchema}.tables`}) is not null as tables,
     exists (select from information_schema.columns where table_schema = ${definitionsSchema} and table_name = 'tables' and column_name = 'version' and column_default is not null) as "versionDefault",
+    exists (select from information_schema.columns where table_schema = ${definitionsSchema} and table_name = 'tables' and column_name = 'table_name') as organizations,
     to_regclass(${`${definitionsSchema}.fields`}) is not null as fields,
     exists (select from pg_namespace where nspname = ${userTablesSchema}) as data,
     exists (select from pg_extension where extname = 'pg_trgm') as trgm`.execute(db);
@@ -14,22 +16,25 @@ const readUserTablesSchema = async (db) => {
 };
 /**
 * The SQL that adds what user tables need: pg_trgm, the definitions schema with its `tables` and `fields`, and the
-* schema the tables themselves live in. `undefined` when current. Nothing is dropped.
+* schema the tables themselves live in. `undefined` when current. Nothing is dropped but the unique constraint on a
+* definition's name, which a name unique per organization replaces.
 */
 const userTablesMigration = async (db) => {
 	const found = await readUserTablesSchema(db);
-	if (found.tables && found.versionDefault && found.fields && found.data && found.trgm) return void 0;
+	if (current(found)) return void 0;
+	const tables = found.tables ? [...found.versionDefault ? [] : [versionDefaultSql()], ...found.organizations ? [] : organizationsSql()] : [tablesSql(), ...nameIndexesSql()];
+	const fields = found.fields ? found.tables && !found.organizations ? [fieldsOrganizationSql()] : [] : [fieldsSql()];
 	return `${[
 		...schemasSql(),
-		...found.tables ? found.versionDefault ? [] : [versionDefaultSql()] : [tablesSql()],
-		...found.fields ? [] : [fieldsSql()]
+		...tables,
+		...fields
 	].join(";\n\n")};`;
 };
 /** Refuses to go on while the schemas of user tables are missing; the project's migrations add them. */
 const checkUserTablesSchema = async (db) => {
 	const found = await readUserTablesSchema(db);
-	if (found.tables && found.versionDefault && found.fields && found.data && found.trgm) return;
-	throw new Error(`The ${definitionsSchema} or ${userTablesSchema} schema, the default of a definition's version, or pg_trgm, is missing, and userTables keeps the tables users add there. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
+	if (current(found)) return;
+	throw new Error(`The ${definitionsSchema} or ${userTablesSchema} schema, the default of a definition's version, a definition's organization, or pg_trgm, is missing, and userTables keeps the tables users add there. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
 };
 //#endregion
 export { checkUserTablesSchema, userTablesMigration };

package/dist/user-tables/table-ddl.js

@@ -1,4 +1,4 @@
-import { nameProblem, userTablesSchema } from "./names.js";
+import { nameProblem, organizationColumn, userTablesSchema } from "./names.js";
 import { sql } from "kysely";
 //#region src/user-tables/table-ddl.ts
 const checkedName = (name, kind) => {
@@ -41,6 +41,11 @@ const indexKind = (type) => {
 };
 /** The new table, with its key alone: its fields are added as columns. */
 const createTableSql = (table) => sql`create table ${tableId(table)} (id bigint generated always as identity primary key)`;
+/**
+* The new table of an organization: its key, and the organization of each record, which `.tenant` sets and every query
+* filters by, with the index that filter reads.
+*/
+const createOrganizationTableSql = (table) => [sql`create table ${tableId(table)} (id bigint generated always as identity primary key, ${sql.id(organizationColumn)} text not null)`, sql`create index on ${tableId(table)} (${sql.id(organizationColumn)})`];
 /** The field's column: nullable and without a default, so the records already there read it as empty. */
 const addColumnSql = (table, field) => sql`alter table ${tableId(table)} add column ${sql.id(checkedName(field.name, "field"))} ${columnType(field)}`;
 const btreeSql = (table, column) => sql`create index on ${tableId(table)} (${sql.id(checkedName(column, "field"))})`;
@@ -53,4 +58,4 @@ const fieldSql = (table, field) => {
 	return [addColumnSql(table, field), ...index];
 };
 //#endregion
-export { addColumnSql, createTableSql, fieldSql, indexKind, trigramIndexSql };
+export { addColumnSql, createOrganizationTableSql, createTableSql, fieldSql, indexKind, trigramIndexSql };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.67.5",
+  "version": "0.67.6",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,9 +44,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.67.5",
-    "@protobase/query": "0.67.5",
-    "@protobase/schema": "0.67.5",
+    "@protobase/layout": "0.67.6",
+    "@protobase/query": "0.67.6",
+    "@protobase/schema": "0.67.6",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",