@reflagged/shell 1.0.3 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reflagged/shell",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "description": "Shared app shell for Reflagged services — OIDC auth, SSO, app switcher",
   "type": "module",
   "sideEffects": false,

package/src/lib/api/oidc-callback.ts

@@ -81,6 +81,7 @@ export async function GET(req: Request): Promise<NextResponse> {
     tenantSlug: asString(claims.tenant_slug),
     orgSlug: asString(claims.org_slug),
     orgRole: asString(claims.org_role),
+    platformRole: asString(claims.platform_role),
     accessibleServices,
   })
 

package/src/lib/auth/oidc-config.ts

@@ -17,6 +17,16 @@ export type OidcSessionToken = {
   tenantSlug?: string | null
   orgSlug?: string | null
   orgRole?: string | null
+  /**
+   * The platform-wide role (`superadmin` · `reflagged_admin` · `tenant_admin`
+   * · `member`), beside `org_role` rather than behind it.
+   *
+   * `org_role` is emitted as `membership ?? platform`, which drops the second
+   * one: a `superadmin` carried as `member` in their own organisation looks
+   * like an ordinary member to a service. A service deriving rights from the
+   * token would lock them out of their own instance at the next sign-in.
+   */
+  platformRole?: string | null
   /** Product keys the user may access; ['*'] = all, [] = none. */
   accessibleServices?: string[] | null
   iat: number

package/src/lib/auth/oidc-cookie.ts

@@ -22,6 +22,7 @@ export async function signSessionCookie(
     tenantSlug?: string | null
     orgSlug?: string | null
     orgRole?: string | null
+    platformRole?: string | null
     accessibleServices?: string[] | null
   },
 ): Promise<string> {
@@ -36,6 +37,7 @@ export async function signSessionCookie(
     tenantSlug: payload.tenantSlug ?? null,
     orgSlug: payload.orgSlug ?? null,
     orgRole: payload.orgRole ?? null,
+    platformRole: payload.platformRole ?? null,
     accessibleServices: payload.accessibleServices ?? null,
   })
     .setProtectedHeader({ alg: ALG })
@@ -65,6 +67,7 @@ export async function verifySessionCookie(
       tenantSlug: typeof payload.tenantSlug === 'string' ? payload.tenantSlug : null,
       orgSlug: typeof payload.orgSlug === 'string' ? payload.orgSlug : null,
       orgRole: typeof payload.orgRole === 'string' ? payload.orgRole : null,
+      platformRole: typeof payload.platformRole === 'string' ? payload.platformRole : null,
       accessibleServices: Array.isArray(payload.accessibleServices)
         ? (payload.accessibleServices as unknown[]).filter((s): s is string => typeof s === 'string')
         : null,