@pylonsync/functions 0.3.385 → 0.4.0

package/dist/auth.d.ts

@@ -0,0 +1,4 @@
+import type { AuthInfo } from "./types";
+export type AuthClaims = Omit<AuthInfo, "elevate">;
+/** Normalize the Rust wire envelope into the public function auth shape. */
+export declare function normalizeAuthClaims(raw: Record<string, unknown>): AuthClaims;

package/dist/types.d.ts

@@ -40,6 +40,10 @@ export interface AuthInfo<R extends AuthRequirement = "optional"> {
     /** Active tenant id (selected organization) for multi-tenant apps.
      *  Null when the session hasn't selected one. */
     tenantId: string | null;
+    /** Exact role slugs for the active organization/session. Custom roles do
+     *  not imply `member` or `admin`; compare explicitly or use
+     *  `ctx.requireMember` for an authoritative membership lookup. */
+    roles: string[];
     /**
      * Promote the call's auth context after the handler has done its
      * own authentication check (HMAC signature verification on a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pylonsync/functions",
-  "version": "0.3.385",
+  "version": "0.4.0",
   "description": "TypeScript function runtime for pylon — defines server-side queries, mutations, and actions.",
   "type": "module",
   "main": "src/index.ts",

package/src/auth.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, test } from "bun:test";
+import { normalizeAuthClaims } from "./auth";
+
+describe("function auth normalization", () => {
+  test("preserves custom roles from the Rust wire envelope", () => {
+    expect(
+      normalizeAuthClaims({
+        user_id: "u1",
+        is_admin: false,
+        tenant_id: "org_1",
+        roles: ["reviewer"],
+      }),
+    ).toEqual({
+      userId: "u1",
+      isAdmin: false,
+      tenantId: "org_1",
+      roles: ["reviewer"],
+    });
+  });
+
+  test("defaults missing roles to an empty array and drops non-strings", () => {
+    expect(normalizeAuthClaims({}).roles).toEqual([]);
+    expect(normalizeAuthClaims({ roles: ["billing", 42, null] }).roles).toEqual([
+      "billing",
+    ]);
+  });
+});

package/src/auth.ts

@@ -0,0 +1,19 @@
+import type { AuthInfo } from "./types";
+
+export type AuthClaims = Omit<AuthInfo, "elevate">;
+
+/** Normalize the Rust wire envelope into the public function auth shape. */
+export function normalizeAuthClaims(
+  raw: Record<string, unknown>,
+): AuthClaims {
+  return {
+    userId:
+      ((raw.userId ?? raw.user_id) as string | null | undefined) ?? null,
+    isAdmin: Boolean(raw.isAdmin ?? raw.is_admin),
+    tenantId:
+      ((raw.tenantId ?? raw.tenant_id) as string | null | undefined) ?? null,
+    roles: Array.isArray(raw.roles)
+      ? raw.roles.filter((role): role is string => typeof role === "string")
+      : [],
+  };
+}

package/src/member.test.ts

@@ -65,6 +65,20 @@ describe("ctx.requireMember", () => {
     ).toBe("FORBIDDEN");
   });
 
+  test("custom roles are exact-match and inherit no built-in role", async () => {
+    const reviewer = { id: "m1", role: "reviewer" };
+    const requireMember = makeRequireMember("u1", spyRead([reviewer]).read);
+
+    expect(
+      await codeOf(() =>
+        requireMember("org_1", { role: ["owner", "admin", "member"] }),
+      ),
+    ).toBe("FORBIDDEN");
+    expect(await requireMember("org_1", { role: ["reviewer"] })).toEqual(
+      reviewer,
+    );
+  });
+
   test("role gate: passes when the member's role IS allowed (string or array)", async () => {
     const owner = { id: "m1", role: "owner" };
     expect(

package/src/runtime.ts

@@ -35,6 +35,7 @@ import type {
   FnDefinition,
   AuthInfo,
 } from "./types";
+import { normalizeAuthClaims } from "./auth";
 import { makeRequireMember } from "./member";
 import { isDevMode } from "./ssr-runtime";
 import { validateArgs } from "./validators";
@@ -1082,11 +1083,7 @@ async function handleCall(msg: CallMessage): Promise<void> {
   // already got camelCase don't regress.
   const rawAuth = msg.auth as unknown as Record<string, unknown>;
   const auth: AuthInfo = {
-    userId: ((rawAuth.userId ?? rawAuth.user_id) as string | null | undefined) ?? null,
-    isAdmin: Boolean(rawAuth.isAdmin ?? rawAuth.is_admin),
-    tenantId:
-      ((rawAuth.tenantId ?? rawAuth.tenant_id) as string | null | undefined) ??
-      null,
+    ...normalizeAuthClaims(rawAuth),
     // `elevate` round-trips through the host runtime which mutates
     // the per-call caller_is_admin flag — that's what subsequent
     // scheduler.runAfter() reads. We also mutate the local

package/src/types.ts

@@ -47,6 +47,10 @@ export interface AuthInfo<R extends AuthRequirement = "optional"> {
   /** Active tenant id (selected organization) for multi-tenant apps.
    *  Null when the session hasn't selected one. */
   tenantId: string | null;
+  /** Exact role slugs for the active organization/session. Custom roles do
+   *  not imply `member` or `admin`; compare explicitly or use
+   *  `ctx.requireMember` for an authoritative membership lookup. */
+  roles: string[];
   /**
    * Promote the call's auth context after the handler has done its
    * own authentication check (HMAC signature verification on a