@protobase/server 0.7.0 → 0.8.1

package/dist/better-auth/organizations/host.js

@@ -0,0 +1,251 @@
+import { membershipRoles } from "./role-definitions.js";
+import { everyRow, findMember, membersOf, organizationRoleOf, setAppRoles } from "./store.js";
+//#region src/better-auth/organizations/host.ts
+const contextOf = async (auth) => await auth.$context;
+const settingsOf = (auth) => {
+	if (!auth.organizations) throw new Error("Organizations are off: pass `organizations` to createAuth");
+	return auth.organizations;
+};
+const organizationRoles = [
+	"owner",
+	"admin",
+	"member"
+];
+const checkOrganizationRole = (role) => {
+	if (!organizationRoles.includes(role)) throw new Error(`Unknown organization role "${role}"; use ${organizationRoles.join(", ")}`);
+	return role;
+};
+const checkAppRoles = (auth, appRoles) => {
+	const holdable = membershipRoles(settingsOf(auth).definitions);
+	const unknown = appRoles.find((name) => !holdable.includes(name));
+	if (unknown !== void 0) throw new Error(`A member cannot hold "${unknown}"; use ${holdable.join(", ")}`);
+	return [...new Set(appRoles)];
+};
+const userByEmail = async (auth, email) => {
+	const user = await (await contextOf(auth)).internalAdapter.findUserByEmail(email.toLowerCase());
+	if (!user) throw new Error(`No user with email ${email}`);
+	return user.user;
+};
+/** An organization by its id or slug. */
+const findOrganizationByKey = async (auth, key) => {
+	const { adapter } = await contextOf(auth);
+	const found = await adapter.findOne({
+		model: "organization",
+		where: [{
+			field: "id",
+			value: key
+		}]
+	}) ?? await adapter.findOne({
+		model: "organization",
+		where: [{
+			field: "slug",
+			value: key
+		}]
+	});
+	if (!found) throw new Error(`No organization "${key}"`);
+	return found;
+};
+const slugPattern = /^[a-z0-9][a-z0-9-]{0,62}$/;
+/**
+* Creates an organization with `owner` (an email) as its owner, holding the creator's app roles. `id` keeps an existing
+* tenant value, for an app that had one organization before; otherwise the configured `generateId` makes one.
+*/
+const createOrganization = async (auth, input) => {
+	const settings = settingsOf(auth);
+	if (!input.name.trim()) throw new Error("The organization needs a name");
+	if (!slugPattern.test(input.slug)) throw new Error(`Invalid slug "${input.slug}": lowercase letters, digits and "-", at most 63`);
+	const owner = await userByEmail(auth, input.owner);
+	const { adapter } = await contextOf(auth);
+	if (await adapter.findOne({
+		model: "organization",
+		where: [{
+			field: "slug",
+			value: input.slug
+		}]
+	})) throw new Error(`An organization with slug "${input.slug}" exists already`);
+	const now = /* @__PURE__ */ new Date();
+	const id = input.id ?? await settings.generateId();
+	const { organization, member } = await adapter.transaction(async (trx) => {
+		const organization = await trx.create({
+			model: "organization",
+			data: {
+				id,
+				name: input.name.trim(),
+				slug: input.slug,
+				createdAt: now
+			},
+			forceAllowId: true
+		});
+		return {
+			organization,
+			member: await trx.create({
+				model: "member",
+				data: {
+					organizationId: organization.id,
+					userId: owner.id,
+					role: "owner",
+					appRoles: settings.creatorAppRoles,
+					createdAt: now
+				}
+			})
+		};
+	});
+	const stored = {
+		...member,
+		appRoles: [...settings.creatorAppRoles]
+	};
+	await settings.options.onCreated?.({
+		organization,
+		member: stored
+	});
+	return {
+		organization,
+		member: stored
+	};
+};
+/** Adds someone with an account as a member: organization role `member` unless given, and the app roles given. */
+const addMember = async (auth, input) => {
+	const organization = await findOrganizationByKey(auth, input.organization);
+	const user = await userByEmail(auth, input.email);
+	const { adapter } = await contextOf(auth);
+	if (await findMember(adapter, {
+		organizationId: organization.id,
+		userId: user.id
+	})) throw new Error(`${input.email} is a member of ${organization.slug} already`);
+	const role = checkOrganizationRole(input.role ?? "member");
+	const appRoles = checkAppRoles(auth, input.appRoles ?? []);
+	return adapter.create({
+		model: "member",
+		data: {
+			organizationId: organization.id,
+			userId: user.id,
+			role,
+			appRoles,
+			createdAt: /* @__PURE__ */ new Date()
+		}
+	});
+};
+const memberOrThrow = async (auth, organizationKey, email) => {
+	const organization = await findOrganizationByKey(auth, organizationKey);
+	const user = await userByEmail(auth, email);
+	const member = await findMember((await contextOf(auth)).adapter, {
+		organizationId: organization.id,
+		userId: user.id
+	});
+	if (!member) throw new Error(`${email} is not a member of ${organization.slug}`);
+	return {
+		organization,
+		member
+	};
+};
+const refuseLastOwner = async (auth, member, action) => {
+	if (organizationRoleOf(member) !== "owner") return;
+	if ((await membersOf((await contextOf(auth)).adapter, member.organizationId)).filter((other) => organizationRoleOf(other) === "owner").length <= 1) throw new Error(`Cannot ${action} the last owner`);
+};
+/** Changes a member's organization role, app roles, or both. */
+const setMemberRoles = async (auth, input) => {
+	const { member } = await memberOrThrow(auth, input.organization, input.email);
+	const { adapter } = await contextOf(auth);
+	if (input.role !== void 0) {
+		const role = checkOrganizationRole(input.role);
+		if (role !== "owner") await refuseLastOwner(auth, member, "demote");
+		await adapter.update({
+			model: "member",
+			where: [{
+				field: "id",
+				value: member.id
+			}],
+			update: { role }
+		});
+	}
+	if (input.appRoles !== void 0) await setAppRoles(adapter, member.id, checkAppRoles(auth, input.appRoles));
+	return findMember(adapter, {
+		organizationId: member.organizationId,
+		userId: member.userId
+	});
+};
+/** Removes a member; refuses the last owner. */
+const removeMember = async (auth, input) => {
+	const { member } = await memberOrThrow(auth, input.organization, input.email);
+	await refuseLastOwner(auth, member, "remove");
+	await (await contextOf(auth)).adapter.delete({
+		model: "member",
+		where: [{
+			field: "id",
+			value: member.id
+		}]
+	});
+};
+/** Every organization, oldest first, with its members' emails and roles. */
+const listOrganizations = async (auth) => {
+	settingsOf(auth);
+	const { adapter, internalAdapter } = await contextOf(auth);
+	const organizations = await adapter.findMany({
+		model: "organization",
+		sortBy: {
+			field: "createdAt",
+			direction: "asc"
+		},
+		limit: everyRow
+	});
+	return Promise.all(organizations.map(async (organization) => ({
+		id: organization.id,
+		name: organization.name,
+		slug: organization.slug,
+		members: await Promise.all((await membersOf(adapter, organization.id)).map(async (member) => ({
+			email: (await internalAdapter.findUserById(member.userId))?.email ?? member.userId,
+			role: organizationRoleOf(member),
+			appRoles: member.appRoles
+		})))
+	})));
+};
+/**
+* Makes `userId` the owner, with the creator's app roles, of every organization without members: for the first user of
+* an app whose organizations were made before anyone could own them, such as by its seed. Returns how many.
+*/
+const ownOrganizationsWithoutMembers = async (auth, userId) => {
+	const settings = settingsOf(auth);
+	const { adapter } = await contextOf(auth);
+	const organizations = await adapter.findMany({
+		model: "organization",
+		limit: everyRow
+	});
+	let owned = 0;
+	for (const organization of organizations) {
+		if ((await membersOf(adapter, organization.id)).length > 0) continue;
+		await adapter.create({
+			model: "member",
+			data: {
+				organizationId: organization.id,
+				userId,
+				role: "owner",
+				appRoles: settings.creatorAppRoles,
+				createdAt: /* @__PURE__ */ new Date()
+			}
+		});
+		owned++;
+	}
+	return owned;
+};
+/** Gives an app role to every owner of every organization, for a role the project adds once organizations exist. */
+const addAppRoleToOwners = async (auth, appRole) => {
+	checkAppRoles(auth, [appRole]);
+	const { adapter } = await contextOf(auth);
+	const owners = (await adapter.findMany({
+		model: "member",
+		limit: everyRow
+	})).filter((member) => organizationRoleOf(member) === "owner");
+	let changed = 0;
+	for (const owner of owners) {
+		const current = (await findMember(adapter, {
+			organizationId: owner.organizationId,
+			userId: owner.userId
+		})).appRoles;
+		if (current.includes(appRole)) continue;
+		await setAppRoles(adapter, owner.id, [...current, appRole]);
+		changed++;
+	}
+	return changed;
+};
+//#endregion
+export { addAppRoleToOwners, addMember, createOrganization, findOrganizationByKey, listOrganizations, ownOrganizationsWithoutMembers, removeMember, setMemberRoles };

package/dist/better-auth/organizations/invitation-endpoints.js

@@ -0,0 +1,133 @@
+import { noGlobalRole } from "./role-definitions.js";
+import { findOrganization } from "./store.js";
+import { invitationLink, invitationToken } from "./invitation-token.js";
+import { effectiveSignInPolicy } from "../sign-in-policy.js";
+import { readSignInPolicy } from "../policy-store.js";
+import { acceptInvitation, invitationOfToken } from "./accept-invitation.js";
+import { APIError, createAuthEndpoint, createAuthMiddleware, sessionMiddleware } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import * as z$1 from "zod";
+//#region src/better-auth/organizations/invitation-endpoints.ts
+const minPasswordLength = 12;
+const maxPasswordLength = 128;
+const tokenBody = z$1.object({ token: z$1.string().min(1) });
+const startIn = (context, sessionToken, organizationId) => context.internalAdapter.updateSession(sessionToken, { activeOrganizationId: organizationId });
+/**
+* The endpoints an emailed invitation link uses: what it is for, accepting it signed in, and creating an account from it
+* for someone who has none. Open sign-up stays off; an invitation is an address someone vouched for, and the link in
+* the mail proves the person reads it.
+*/
+const invitationEndpoints = ({ resolved, mail }) => ({
+	/** `GET /invitation?token=`: the organization, who invites, the address and roles, until when, and whether the address has an account. */
+	getInvitation: createAuthEndpoint("/invitation", {
+		method: "GET",
+		query: tokenBody
+	}, async (ctx) => {
+		const invitation = await invitationOfToken(ctx.context, ctx.query.token);
+		const organization = await findOrganization(ctx.context.adapter, invitation.organizationId);
+		const inviter = await ctx.context.internalAdapter.findUserById(invitation.inviterId);
+		const account = await ctx.context.internalAdapter.findUserByEmail(invitation.email.toLowerCase());
+		return ctx.json({
+			organization: {
+				id: invitation.organizationId,
+				name: organization?.name ?? ""
+			},
+			inviter: { name: inviter?.name || inviter?.email || "" },
+			email: invitation.email,
+			role: invitation.role,
+			appRoles: invitation.appRoles,
+			expiresAt: new Date(invitation.expiresAt).toISOString(),
+			hasAccount: Boolean(account)
+		});
+	}),
+	/** `POST /invitation/accept` with `{ token }`, signed in as the invited address: becomes a member, and works there. */
+	acceptInvitation: createAuthEndpoint("/invitation/accept", {
+		method: "POST",
+		body: tokenBody,
+		use: [sessionMiddleware]
+	}, async (ctx) => {
+		const invitation = await invitationOfToken(ctx.context, ctx.body.token);
+		const { user, session } = ctx.context.session;
+		const member = await acceptInvitation(ctx.context, invitation, user, resolved.membershipLimit);
+		await startIn(ctx.context, session.token, invitation.organizationId);
+		return ctx.json({ member });
+	}),
+	/**
+	* `POST /invitation/sign-up` with `{ token, name, password? }`, for an address without an account: creates it, as
+	* verified and with no global role, accepts the invitation and signs the person in there. A password is needed unless
+	* the sign-in policy offers emailed codes; the policy's required methods are then set up as after any sign-in.
+	*/
+	signUpFromInvitation: createAuthEndpoint("/invitation/sign-up", {
+		method: "POST",
+		body: z$1.object({
+			token: z$1.string().min(1),
+			name: z$1.string().trim().min(1).max(200),
+			password: z$1.string().optional()
+		})
+	}, async (ctx) => {
+		const invitation = await invitationOfToken(ctx.context, ctx.body.token);
+		const { internalAdapter } = ctx.context;
+		if (await internalAdapter.findUserByEmail(invitation.email.toLowerCase())) throw new APIError("BAD_REQUEST", {
+			code: "ACCOUNT_EXISTS",
+			message: "This address has an account already: sign in to accept the invitation."
+		});
+		const policy = effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter)).policy, { mail });
+		const { password } = ctx.body;
+		if (password !== void 0 && policy.password === "forbidden") throw new APIError("BAD_REQUEST", {
+			code: "SIGN_IN_METHOD_FORBIDDEN",
+			message: "This app does not sign in with passwords; leave the password out."
+		});
+		if (password === void 0 && policy.emailCode !== "allowed") throw new APIError("BAD_REQUEST", {
+			code: "PASSWORD_REQUIRED",
+			message: "Choose a password to sign in with."
+		});
+		if (password !== void 0 && (password.length < minPasswordLength || password.length > maxPasswordLength)) throw new APIError("BAD_REQUEST", {
+			code: "PASSWORD_LENGTH",
+			message: `Choose a password of ${minPasswordLength} to ${maxPasswordLength} characters.`
+		});
+		const user = await internalAdapter.createUser({
+			email: invitation.email.toLowerCase(),
+			name: ctx.body.name,
+			emailVerified: true,
+			role: noGlobalRole
+		}, { method: "invitation" });
+		if (password !== void 0) await internalAdapter.linkAccount({
+			userId: user.id,
+			providerId: "credential",
+			accountId: user.id,
+			password: await ctx.context.password.hash(password)
+		});
+		const member = await acceptInvitation(ctx.context, invitation, user, resolved.membershipLimit);
+		const session = await internalAdapter.createSession(user.id, false);
+		await startIn(ctx.context, session.token, invitation.organizationId);
+		await setSessionCookie(ctx, {
+			session: {
+				...session,
+				activeOrganizationId: invitation.organizationId
+			},
+			user
+		});
+		return ctx.json({ member });
+	})
+});
+/**
+* Without a mailer the invitation cannot be emailed, so whoever invites gets its link in the answer, once, to pass on.
+* Resending gives a new link, since it moves the expiry.
+*/
+const invitationLinkHook = (resolved) => ({
+	matcher: (context) => context.path === "/organization/invite-member",
+	handler: createAuthMiddleware(async (ctx) => {
+		const returned = ctx.context.returned;
+		if (!returned || returned instanceof Response || returned instanceof Error || !returned.id || !returned.expiresAt) return;
+		const token = await invitationToken(ctx.context.secret, {
+			id: returned.id,
+			expiresAt: new Date(returned.expiresAt)
+		});
+		ctx.context.returned = {
+			...returned,
+			link: invitationLink(resolved.invitationUrl, token)
+		};
+	})
+});
+//#endregion
+export { invitationEndpoints, invitationLinkHook };

package/dist/better-auth/organizations/invitation-mail.js

@@ -0,0 +1,17 @@
+//#region src/better-auth/organizations/invitation-mail.ts
+/** The invitation email: who invites whom to which organization, the link, and until when it works. */
+const invitationEmail = ({ to, inviter, organization, url, expiresAt }) => ({
+	to,
+	subject: `Join ${organization}`,
+	text: [
+		`${inviter} invites you to join ${organization}. To accept, open this link:`,
+		"",
+		url,
+		"",
+		`The link works until ${new Date(expiresAt).toUTCString()}.`,
+		"If you do not want to join, ignore this email: nothing happens without you.",
+		""
+	].join("\n")
+});
+//#endregion
+export { invitationEmail };

package/dist/better-auth/organizations/invitation-token.js

@@ -0,0 +1,27 @@
+//#region src/better-auth/organizations/invitation-token.ts
+const encoder = new TextEncoder();
+const base64url = (bytes) => btoa(String.fromCharCode(...new Uint8Array(bytes))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+const signature = async (secret, id, expiresAt) => {
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return base64url(await crypto.subtle.sign("HMAC", key, encoder.encode(`invitation:${id}:${new Date(expiresAt).getTime()}`)));
+};
+const invitationToken = async (secret, invitation) => `${invitation.id}.${await signature(secret, invitation.id, invitation.expiresAt)}`;
+/** The invitation id a token names; the signature is checked against the stored expiry with `verifyInvitationToken`. */
+const invitationIdOf = (token) => {
+	const dot = token.lastIndexOf(".");
+	return dot > 0 ? token.slice(0, dot) : void 0;
+};
+const verifyInvitationToken = async (secret, token, invitation) => {
+	const expected = await invitationToken(secret, invitation);
+	if (expected.length !== token.length) return false;
+	let difference = 0;
+	for (let index = 0; index < expected.length; index++) difference |= expected.charCodeAt(index) ^ token.charCodeAt(index);
+	return difference === 0;
+};
+/** The link in the email: the app's invitation page with the token. */
+const invitationLink = (pageUrl, token) => `${pageUrl}?token=${encodeURIComponent(token)}`;
+//#endregion
+export { invitationIdOf, invitationLink, invitationToken, verifyInvitationToken };

package/dist/better-auth/organizations/member-endpoints.js

@@ -0,0 +1,182 @@
+import "./role-definitions.js";
+import { checkAppRoleChange, effectiveRoles, globalRoles } from "./app-roles.js";
+import { findMember, findMemberById, findOrganization, organizationRoleOf, setAppRoles } from "./store.js";
+import { APIError, createAuthEndpoint, sessionMiddleware } from "better-auth/api";
+import * as z$1 from "zod";
+//#region src/better-auth/organizations/member-endpoints.ts
+const memberNotFound = {
+	code: "MEMBER_NOT_FOUND",
+	message: "There is no such member."
+};
+const searchLimit = 20;
+/**
+* Protobase's member endpoints beside Better Auth's: changing a member's app roles, handing ownership over in one step,
+* and, for people with a global role, finding any organization to work in.
+*/
+const memberEndpoints = ({ resolved }) => ({
+	/**
+	* `POST /organization/set-app-roles` with `{ memberId, appRoles }`, by the organization's owners and admins, or a
+	* superuser: only roles the caller may give change (`checkAppRoleChange`).
+	*/
+	setAppRoles: createAuthEndpoint("/organization/set-app-roles", {
+		method: "POST",
+		use: [sessionMiddleware],
+		body: z$1.object({
+			memberId: z$1.string().min(1),
+			appRoles: z$1.array(z$1.string())
+		})
+	}, async (ctx) => {
+		const { adapter } = ctx.context;
+		const { user } = ctx.context.session;
+		const target = await findMemberById(adapter, ctx.body.memberId);
+		if (!target) throw new APIError("BAD_REQUEST", memberNotFound);
+		const actor = await findMember(adapter, {
+			organizationId: target.organizationId,
+			userId: user.id
+		});
+		const global = globalRoles(user.role);
+		if (!(global.includes("admin") || actor !== void 0 && organizationRoleOf(actor) !== "member")) throw new APIError("FORBIDDEN", {
+			code: "NOT_AN_ORGANIZATION_ADMIN",
+			message: "Only the organization's owners and admins can change members' roles."
+		});
+		const after = [...new Set(ctx.body.appRoles)];
+		const refusal = checkAppRoleChange({
+			held: effectiveRoles(global, actor?.appRoles),
+			before: target.appRoles,
+			after,
+			definitions: resolved.definitions
+		});
+		if (refusal) throw new APIError(refusal.status, {
+			code: refusal.code,
+			message: refusal.message
+		});
+		await setAppRoles(adapter, target.id, after);
+		return ctx.json({ member: {
+			...target,
+			appRoles: after
+		} });
+	}),
+	/**
+	* `POST /organization/transfer-ownership` with `{ memberId, keepAs? }`, by an owner: in one transaction the member
+	* becomes owner and the caller `keepAs` (`admin` unless `member`). App roles stay as they are.
+	*/
+	transferOwnership: createAuthEndpoint("/organization/transfer-ownership", {
+		method: "POST",
+		use: [sessionMiddleware],
+		body: z$1.object({
+			memberId: z$1.string().min(1),
+			keepAs: z$1.enum(["admin", "member"]).optional()
+		})
+	}, async (ctx) => {
+		const { adapter } = ctx.context;
+		const target = await findMemberById(adapter, ctx.body.memberId);
+		if (!target) throw new APIError("BAD_REQUEST", memberNotFound);
+		const actor = await findMember(adapter, {
+			organizationId: target.organizationId,
+			userId: ctx.context.session.user.id
+		});
+		if (!actor || organizationRoleOf(actor) !== "owner") throw new APIError("FORBIDDEN", {
+			code: "NOT_THE_OWNER",
+			message: "Only an owner can hand the organization over."
+		});
+		if (actor.id === target.id) throw new APIError("BAD_REQUEST", {
+			code: "ALREADY_THE_OWNER",
+			message: "Choose another member to hand the organization over to."
+		});
+		await adapter.transaction(async (trx) => {
+			await trx.update({
+				model: "member",
+				where: [{
+					field: "id",
+					value: target.id
+				}],
+				update: { role: "owner" }
+			});
+			await trx.update({
+				model: "member",
+				where: [{
+					field: "id",
+					value: actor.id
+				}],
+				update: { role: ctx.body.keepAs ?? "admin" }
+			});
+		});
+		return ctx.json({ owner: target.id });
+	}),
+	/**
+	* `GET /organization/current`: the organization the session works in, with the caller's organization role and app
+	* roles there (none for someone with a global role who is not a member) and their global roles; `null` for none.
+	*/
+	currentOrganization: createAuthEndpoint("/organization/current", {
+		method: "GET",
+		use: [sessionMiddleware]
+	}, async (ctx) => {
+		const { user, session } = ctx.context.session;
+		const global = globalRoles(user.role);
+		const organizationId = session.activeOrganizationId;
+		const organization = organizationId ? await findOrganization(ctx.context.adapter, organizationId) : null;
+		if (!organization) return ctx.json({
+			organization: null,
+			globalRoles: global
+		});
+		const member = await findMember(ctx.context.adapter, {
+			organizationId: organization.id,
+			userId: user.id
+		});
+		if (!member && global.length === 0) return ctx.json({
+			organization: null,
+			globalRoles: global
+		});
+		const { id, name, slug, logo } = organization;
+		return ctx.json({
+			organization: {
+				id,
+				name,
+				slug,
+				logo: logo ?? null
+			},
+			...member && {
+				role: organizationRoleOf(member),
+				appRoles: member.appRoles,
+				memberId: member.id
+			},
+			globalRoles: global
+		});
+	}),
+	/**
+	* `GET /organization/search?query=`, for someone with a global role, who may work in any organization: the first
+	* organizations whose name or slug contains the text, by name.
+	*/
+	searchOrganizations: createAuthEndpoint("/organization/search", {
+		method: "GET",
+		use: [sessionMiddleware],
+		query: z$1.object({ query: z$1.string().default("") })
+	}, async (ctx) => {
+		if (globalRoles(ctx.context.session.user.role).length === 0) throw new APIError("FORBIDDEN", {
+			code: "GLOBAL_ROLE_REQUIRED",
+			message: "Only people with a global role can open organizations they are not a member of."
+		});
+		const text = ctx.query.query.trim();
+		const find = (field) => ctx.context.adapter.findMany({
+			model: "organization",
+			...text && { where: [{
+				field,
+				value: text,
+				operator: "contains"
+			}] },
+			sortBy: {
+				field: "name",
+				direction: "asc"
+			},
+			limit: searchLimit
+		});
+		const organizations = [...new Map([...await find("name"), ...text ? await find("slug") : []].map((organization) => [organization.id, organization])).values()].sort((a, b) => a.name.localeCompare(b.name)).slice(0, searchLimit);
+		return ctx.json({ organizations: organizations.map(({ id, name, slug }) => ({
+			id,
+			name,
+			slug
+		})) });
+	})
+});
+//#endregion
+export { memberEndpoints };

package/dist/better-auth/organizations/options.d.ts

@@ -0,0 +1,48 @@
+import { RoleDefinitions } from "./role-definitions.js";
+import { StoredMember, StoredOrganization } from "./store.js";
+import { OrganizationOptions } from "better-auth/plugins/organization";
+//#region src/better-auth/organizations/options.d.ts
+type OrganizationHooks = NonNullable<OrganizationOptions['organizationHooks']>;
+export type OrganizationsOptions = {
+  /** The app roles an organization's creator holds there: `'all'` (default), every role a member can hold, or a list. */
+  creatorAppRoles?: 'all' | string[];
+  /** Who may create organizations: `'admins'` (default), superusers only, or `'everyone'` signed in. */
+  create?: 'admins' | 'everyone';
+  /** How long an invitation works, in days. Default 7. */
+  invitationDays?: number;
+  /** The most members an organization can have. Default 1000. */
+  membershipLimit?: number;
+  /**
+   * The id of a new organization. Default `crypto.randomUUID()`. `.tenant` columns hold it: `text` or `uuid` for the
+   * default, or an integer column when this takes the next value of the app's own organizations sequence.
+   */
+  generateId?: () => string | Promise<string>;
+  /**
+   * What deleting an organization does with its records: `'refuse'` (default) deletes only an organization without
+   * rows in any `.tenant` resource; `'cascade'` leaves it to the project's foreign keys.
+   */
+  deleteRecords?: 'refuse' | 'cascade';
+  /** The page an invitation link opens, with `?token=`. Default `{baseURL}/-/invitation`. */
+  invitationUrl?: string;
+  /** Runs after an organization is created, with its owner's membership, for example to add the app's own row for it. */
+  onCreated?: (input: {
+    organization: StoredOrganization;
+    member: StoredMember;
+  }) => Promise<void>;
+  /** Runs before an organization is deleted; throwing refuses the deletion. */
+  beforeDelete?: (organization: StoredOrganization) => Promise<void>;
+  /** Better Auth's organization hooks, run after Protobase's own. */
+  hooks?: OrganizationHooks;
+};
+export type ResolvedOrganizations = {
+  definitions: RoleDefinitions;
+  creatorAppRoles: string[];
+  create: 'admins' | 'everyone';
+  invitationExpiresIn: number;
+  membershipLimit: number;
+  generateId: () => string | Promise<string>;
+  deleteRecords: 'refuse' | 'cascade';
+  invitationUrl: string;
+  options: OrganizationsOptions;
+};
+//#endregion

package/dist/better-auth/organizations/options.js

@@ -0,0 +1,23 @@
+import { membershipRoles } from "./role-definitions.js";
+//#region src/better-auth/organizations/options.ts
+const resolveOrganizations = (options, definitions, baseURL) => {
+	const holdable = membershipRoles(definitions);
+	const creatorAppRoles = options.creatorAppRoles === void 0 || options.creatorAppRoles === "all" ? holdable : options.creatorAppRoles;
+	const unknown = creatorAppRoles.find((name) => !holdable.includes(name));
+	if (unknown !== void 0) throw new Error(`creatorAppRoles names "${unknown}", which a member cannot hold: ${holdable.join(", ")}`);
+	const days = options.invitationDays ?? 7;
+	if (!(days > 0)) throw new Error("invitationDays must be more than 0");
+	return {
+		definitions,
+		creatorAppRoles,
+		create: options.create ?? "admins",
+		invitationExpiresIn: Math.round(days * 24 * 60 * 60),
+		membershipLimit: options.membershipLimit ?? 1e3,
+		generateId: options.generateId ?? (() => crypto.randomUUID()),
+		deleteRecords: options.deleteRecords ?? "refuse",
+		invitationUrl: options.invitationUrl ?? `${baseURL.replace(/\/$/, "")}/-/invitation`,
+		options
+	};
+};
+//#endregion
+export { resolveOrganizations };