@selvajs/selva 4.6.18 → 4.6.20

package/build/server/chunks/chunks/{permissions.server.js-B1Spnvnp.js → permissions.server.js-IiOUZVAf.js}

@@ -1,8 +1,8 @@
-import { a as getPermissionStore } from './providers.server.js-Sbk117pY.js';
+import { a as getPermissionStore } from './providers.server.js-Dwaws7YS.js';
 
 async function setUserPlatformPermissions(ctx, userId, permissions) {
   return getPermissionStore().set(ctx, userId, permissions);
 }
 
 export { setUserPlatformPermissions as s };
-//# sourceMappingURL=permissions.server.js-B1Spnvnp.js.map
+//# sourceMappingURL=permissions.server.js-IiOUZVAf.js.map

package/build/server/chunks/chunks/{permissions.server.js-B1Spnvnp.js.map → permissions.server.js-IiOUZVAf.js.map}

@@ -1 +1 @@
-{"version":3,"file":"permissions.server.js-B1Spnvnp.js","sources":["../../../../.svelte-kit/output/server/chunks/permissions.server.js"],"sourcesContent":["import { m as getPermissionStore } from \"./providers.server.js\";\nasync function setUserPlatformPermissions(ctx, userId, permissions) {\n  return getPermissionStore().set(ctx, userId, permissions);\n}\nexport {\n  setUserPlatformPermissions as s\n};\n"],"names":[],"mappings":";;AACA,eAAe,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE;AACpE,EAAE,OAAO,kBAAkB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC;AAC3D;;;;"}
+{"version":3,"file":"permissions.server.js-IiOUZVAf.js","sources":["../../../../.svelte-kit/output/server/chunks/permissions.server.js"],"sourcesContent":["import { m as getPermissionStore } from \"./providers.server.js\";\nasync function setUserPlatformPermissions(ctx, userId, permissions) {\n  return getPermissionStore().set(ctx, userId, permissions);\n}\nexport {\n  setUserPlatformPermissions as s\n};\n"],"names":[],"mappings":";;AACA,eAAe,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE;AACpE,EAAE,OAAO,kBAAkB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC;AAC3D;;;;"}

package/build/server/chunks/chunks/{providers.server.js-Sbk117pY.js → providers.server.js-Dwaws7YS.js}

@@ -1823,14 +1823,22 @@ class LocalDataProvider {
   }
   /**
    * Cascade hook called after the auth provider deletes a user. Removes the
-   * matching `user-data.json` row so the data layer doesn't accumulate
-   * orphans. Tolerates missing rows.
+   * matching `user-data.json` row and every live org membership so the data
+   * layer doesn't accumulate orphans — a leftover membership renders as a
+   * bare user ID in the team roster forever. (Supabase gets the membership
+   * cascade from FK constraints; local must do it explicitly.) Tolerates
+   * missing rows.
    */
-  async onUserDeleted(_ctx, userId) {
+  async onUserDeleted(ctx, userId) {
     try {
       await this.userData.deleteUser(userId);
     } catch {
     }
+    for (let i = 0; i < 100; i++) {
+      const membership = await this.orgs.findUserMembership(ctx, userId);
+      if (!membership) break;
+      await this.orgs.removeOrgMember(ctx, membership.org.id, userId);
+    }
   }
   static fromEnv(env, events = new NoopEventSink()) {
     if (!env.DATA_PATH) throw new Error("Missing required env var: DATA_PATH");
@@ -3948,16 +3956,16 @@ function createAllowlistStore(filePath) {
       await writeFile(filePath, file);
       return entry;
     },
-    async materializeFromHeaders(id, fields) {
+    async syncFromHeaders(id, fields) {
       const file = await readFile(filePath);
       const user = file.users.find((u) => u.id === id);
       if (!user) return;
       let dirty = false;
-      if (!user.email && fields.email) {
+      if (fields.email && user.email !== fields.email) {
         user.email = fields.email;
         dirty = true;
       }
-      if (!user.displayName && fields.displayName) {
+      if (fields.displayName && user.displayName !== fields.displayName) {
         user.displayName = fields.displayName;
         dirty = true;
       }
@@ -4008,7 +4016,12 @@ const DEFAULT_HEADERS = {
 function toAuthUser(u) {
   return {
     id: u.id,
-    email: u.email,
+    // Pre-first-login rows have no materialized email yet — the UPN is what
+    // the admin typed when allowlisting (their email, for Entra/M365) and is
+    // the only human-readable identifier available. Fall back so user lists
+    // show an address instead of a bare UUID until the real email arrives
+    // via header materialization.
+    email: u.email ?? u.upn,
     metadata: { upn: u.upn, displayName: u.displayName },
     createdAt: u.createdAt,
     lastLoginAt: u.lastLoginAt,
@@ -4082,11 +4095,11 @@ class HeaderProxyAuth {
     if (!entry || entry.disabled) {
       return null;
     }
-    if (!entry.email && email || !entry.displayName && displayName) {
-      await this.users.materializeFromHeaders(entry.id, { email, displayName }).catch(() => {
+    if (email && entry.email !== email || displayName && entry.displayName !== displayName) {
+      await this.users.syncFromHeaders(entry.id, { email, displayName }).catch(() => {
       });
-      if (email && !entry.email) entry.email = email;
-      if (displayName && !entry.displayName) entry.displayName = displayName;
+      if (email) entry.email = email;
+      if (displayName) entry.displayName = displayName;
     }
     await this.users.touchLastLogin(entry.id).catch(() => {
     });
@@ -4540,4 +4553,4 @@ function getAuditQuery() {
 }
 
 export { LocalComputeServerStore as L, MAX_PAGE_LIMIT as M, ProviderError as P, getPermissionStore as a, getTenancy as b, getDataProvider as c, getOrganizationProvider as d, getProjectProvider as e, flag as f, getAuthProvider as g, getBranding as h, isPlatformServer as i, getComputeServerConfigStore as j, getDefinitionMeta as k, getPlatformProjectGrantStore as l, getAuditQuery as m, getInviteStore as n, getUserProfileStore as o, providers as p, getStorageProvider as q, isOrgServer as r, getOrgAssetService as s, getSolveMetricSink as t, getDefinitionService as u, definitionPaths as v };
-//# sourceMappingURL=providers.server.js-Sbk117pY.js.map
+//# sourceMappingURL=providers.server.js-Dwaws7YS.js.map