@riffdb/better-auth 0.2.0 → 0.2.1

package/profiles/organization-security/materialization.json

@@ -44,5 +44,8 @@
       "targetModel": "team",
       "reason": "cross_aggregate_edge"
     }
+  ],
+  "requiredUniqueValues": [
+    "teamMember.membershipKey"
   ]
 }

package/profiles/organization-security/riffdb/contract.riff

@@ -84,6 +84,7 @@ contract BetterAuthOrganizationSecurity version 1 {
   entity Team {
     key (tenant_id: uuid, organization_id: uuid, team_id: uuid)
     field created_at: timestamp
+    field secret member_count: i64
     field name: string<2048>
     field updated_at: optional<timestamp>
     field revision: u64
@@ -95,8 +96,11 @@ contract BetterAuthOrganizationSecurity version 1 {
   entity TeamMember {
     key (tenant_id: uuid, user_id: uuid, team_member_id: uuid)
     field created_at: optional<timestamp>
+    field secret membership_key: string<2048>
     field team_id: uuid
     field revision: u64
+    unique team_member_membership_key (tenant_id, membership_key)
+    index by_membership_key (tenant_id, membership_key, user_id, team_member_id)
     index by_team_id (tenant_id, team_id, user_id, team_member_id)
     index by_parent (tenant_id, user_id, team_member_id)
     reference team_member_parent (tenant_id, user_id) -> User(tenant_id, user_id)
@@ -500,12 +504,14 @@ contract BetterAuthOrganizationSecurity version 1 {
     input organization_id: uuid
     input team_id: uuid
     input created_at: timestamp
+    input member_count: i64
     input name: string<2048>
     input updated_at: optional<timestamp>
     idempotency_key request_id
     read Organization(tenant_id, organization_id) as organization else TeamParentMissing {}
     create Team(tenant_id, organization_id, team_id) as team else TeamAlreadyExists {}
     set team.created_at = created_at
+    set team.member_count = member_count
     set team.name = name
     set team.updated_at = updated_at
     set team.revision = 1
@@ -519,12 +525,14 @@ contract BetterAuthOrganizationSecurity version 1 {
     input team_id: uuid
     input expected_revision: u64
     input created_at: timestamp
+    input member_count: i64
     input name: string<2048>
     input updated_at: optional<timestamp>
     idempotency_key request_id
     mutate Team(tenant_id, organization_id, team_id) as team else TeamUpdateMissing {}
     require current_revision: team.revision == expected_revision else TeamUpdateStale {}
     set team.created_at = created_at checked_by current_revision
+    set team.member_count = member_count checked_by current_revision
     set team.name = name checked_by current_revision
     set team.updated_at = updated_at checked_by current_revision
     set team.revision = team.revision + 1
@@ -549,11 +557,13 @@ contract BetterAuthOrganizationSecurity version 1 {
     input user_id: uuid
     input team_member_id: uuid
     input created_at: optional<timestamp>
+    input membership_key: string<2048>
     input team_id: uuid
     idempotency_key request_id
     read User(tenant_id, user_id) as user else TeamMemberParentMissing {}
     create TeamMember(tenant_id, user_id, team_member_id) as team_member else TeamMemberAlreadyExists {}
     set team_member.created_at = created_at
+    set team_member.membership_key = membership_key
     set team_member.team_id = team_id
     set team_member.revision = 1
     return TeamMemberCreated {}
@@ -566,11 +576,13 @@ contract BetterAuthOrganizationSecurity version 1 {
     input team_member_id: uuid
     input expected_revision: u64
     input created_at: optional<timestamp>
+    input membership_key: string<2048>
     input team_id: uuid
     idempotency_key request_id
     mutate TeamMember(tenant_id, user_id, team_member_id) as team_member else TeamMemberUpdateMissing {}
     require current_revision: team_member.revision == expected_revision else TeamMemberUpdateStale {}
     set team_member.created_at = created_at checked_by current_revision
+    set team_member.membership_key = membership_key checked_by current_revision
     set team_member.team_id = team_id checked_by current_revision
     set team_member.revision = team_member.revision + 1
     return TeamMemberUpdated {}

package/profiles/organization-security/riffdb/queries/find_team_by_id.riffq

@@ -11,7 +11,7 @@ query FindTeamById(
         take 1
 
     return Found {
-        teams: teams { organization_id team_id created_at name updated_at revision }
+        teams: teams { organization_id team_id created_at member_count reveals teams.member_count name updated_at revision }
     }
 
     outcomes Found

package/profiles/organization-security/riffdb/queries/find_team_member_by_id.riffq

@@ -11,7 +11,7 @@ query FindTeamMemberById(
         take 1
 
     return Found {
-        team_members: team_members { user_id team_member_id created_at team_id revision }
+        team_members: team_members { user_id team_member_id created_at membership_key reveals team_members.membership_key team_id revision }
     }
 
     outcomes Found

package/profiles/organization-security/riffdb/queries/find_team_member_by_membership_key.riffq

@@ -0,0 +1,16 @@
+query FindTeamMemberByMembershipKey(
+    $tenant_id: TeamMember.tenant_id,
+    $membership_key: TeamMember.membership_key,
+) {
+    many team_members from TeamMember
+        where tenant_id == $tenant_id
+          && membership_key == $membership_key
+        order by user_id asc, team_member_id asc
+        take 1
+
+    return Found {
+        team_members: team_members { user_id team_member_id created_at membership_key reveals team_members.membership_key team_id revision }
+    }
+
+    outcomes Found
+}

package/profiles/organization-security/riffdb/queries/find_team_member_by_team_id.riffq

@@ -10,7 +10,7 @@ query FindTeamMemberByTeamId(
         take 50 after $after
 
     return Found {
-        team_members: team_members { user_id team_member_id created_at team_id revision }
+        team_members: team_members { user_id team_member_id created_at membership_key reveals team_members.membership_key team_id revision }
     }
 
     outcomes Found

package/profiles/organization-security/riffdb.application.json

@@ -67,6 +67,10 @@
           "name": "FindTeamMemberById",
           "source": "riffdb/queries/find_team_member_by_id.riffq"
         },
+        {
+          "name": "FindTeamMemberByMembershipKey",
+          "source": "riffdb/queries/find_team_member_by_membership_key.riffq"
+        },
         {
           "name": "FindTeamMemberByTeamId",
           "source": "riffdb/queries/find_team_member_by_team_id.riffq"
@@ -117,6 +121,7 @@
         "FindSessionByToken",
         "FindTeamById",
         "FindTeamMemberById",
+        "FindTeamMemberByMembershipKey",
         "FindTeamMemberByTeamId",
         "FindTwoFactorById",
         "FindTwoFactorBySecret",

package/profiles/organization-security.profile.json

@@ -1,6 +1,6 @@
 {
   "schema": "riffdb.better-auth-profile-plan/v1",
-  "betterAuthVersion": "1.6.29",
+  "betterAuthVersion": "1.7.18",
   "idGeneration": "uuid",
   "name": "BetterAuthOrganizationSecurity",
   "contract": {
@@ -579,6 +579,19 @@
           "hasDefault": false,
           "hasOnUpdate": false
         },
+        {
+          "name": "memberCount",
+          "storageName": "memberCount",
+          "type": "number",
+          "required": true,
+          "unique": false,
+          "indexed": false,
+          "secret": true,
+          "input": false,
+          "returned": false,
+          "hasDefault": true,
+          "hasOnUpdate": false
+        },
         {
           "name": "name",
           "storageName": "name",
@@ -641,6 +654,19 @@
           "hasDefault": false,
           "hasOnUpdate": false
         },
+        {
+          "name": "membershipKey",
+          "storageName": "membershipKey",
+          "type": "string",
+          "required": false,
+          "unique": true,
+          "indexed": false,
+          "secret": true,
+          "input": false,
+          "returned": false,
+          "hasDefault": false,
+          "hasOnUpdate": false
+        },
         {
           "name": "teamId",
           "storageName": "teamId",