@shaferllc/keel 0.81.0 → 0.81.2

package/dist/core/model-events.js

@@ -53,13 +53,31 @@ export function clearModelHooks(cls) {
     if (cls)
         registry.delete(cls);
 }
+/**
+ * Every hook for an event that applies to `cls`, including ones registered on its
+ * ancestors — ancestors first, so a base class's hook runs before its subclass's.
+ *
+ * Inheritance is what makes a base class useful. `class Post extends TenantModel`
+ * has to fire TenantModel's `creating` hook (the one that stamps the tenant id), or
+ * the row is written with no owner and the base class is decorative.
+ */
+function hooksFor(cls, event) {
+    const chain = [];
+    for (let c = cls; c && c !== Function.prototype; c = Object.getPrototypeOf(c)) {
+        chain.unshift(c);
+    }
+    const hooks = [];
+    for (const link of chain)
+        hooks.push(...(registry.get(link)?.get(event) ?? []));
+    return hooks;
+}
 /**
  * Fire an event's hooks in registration order. Returns `false` only when a
  * cancelable event had a hook return `false` — the caller then skips the write.
  */
 export async function fireModelEvent(cls, event, model) {
-    const hooks = registry.get(cls)?.get(event);
-    if (!hooks?.length)
+    const hooks = hooksFor(cls, event);
+    if (!hooks.length)
         return true;
     const cancelable = CANCELABLE.has(event);
     for (const hook of hooks) {

package/dist/core/model.d.ts

@@ -21,7 +21,15 @@ import { type Casts } from "./casts.js";
 import { type ModelHook, type ModelObserver } from "./model-events.js";
 import { ModelQuery } from "./model-query.js";
 /** A global scope: a constraint applied to every query a model builds. */
-export type GlobalScope = (query: QueryBuilder) => void;
+/**
+ * A global scope: a constraint applied to every query a model builds.
+ *
+ * The second argument is the model the query is being built for — which a scope
+ * declared on a *base* class needs, since it runs for every subclass and they may
+ * not all be configured the same way (a tenant scope reading each model's own
+ * `teamColumn`, say).
+ */
+export type GlobalScope = (query: QueryBuilder, model: typeof Model) => void;
 /** How a model query treats soft-deleted rows. */
 type TrashedMode = "exclude" | "with" | "only";
 type ModelClass<T extends Model> = (new (attributes?: Row) => T) & typeof Model;
@@ -54,9 +62,19 @@ export declare class Model {
     /** Register a global scope — a constraint applied to every query this model builds. */
     static addGlobalScope(name: string, scope: GlobalScope): void;
     /** Build this model's base query, applying global scopes and the soft-delete filter. */
-    protected static baseQuery(trashed?: TrashedMode): QueryBuilder;
+    protected static baseQuery(trashed?: TrashedMode, skip?: Set<string>): QueryBuilder;
     /** A query builder scoped to this model's table (global scopes applied). */
     static query(): QueryBuilder;
+    /**
+     * Drop named global scopes from this query.
+     *
+     * Deliberately explicit and greppable: a query that escapes a tenancy scope is
+     * exactly the thing you want to be able to find at audit time, so it has to be
+     * *typed out*, not arrived at by forgetting something.
+     */
+    static withoutGlobalScope(...names: string[]): QueryBuilder;
+    /** Drop every global scope. Same warning, louder. */
+    static withoutGlobalScopes(): QueryBuilder;
     /** Include soft-deleted rows (bypasses the soft-delete scope). */
     static withTrashed(): QueryBuilder;
     /** Only soft-deleted rows. */

package/dist/core/model.js

@@ -21,8 +21,37 @@ import { BelongsTo, BelongsToMany, HasMany, HasOne, MorphMany, MorphOne, MorphTo
 import { applyCasts, castGet, castSet } from "./casts.js";
 import { addModelHook, addModelObserver, fireModelEvent, } from "./model-events.js";
 import { ModelQuery } from "./model-query.js";
-/** Registered global scopes, keyed by the model class. */
+/** Registered global scopes, keyed by the model class they were declared on. */
 const globalScopes = new WeakMap();
+/**
+ * Every scope that applies to `cls`, including ones declared on its ancestors.
+ *
+ * Inheritance is the whole point: a base class exists so its subclasses are
+ * constrained by it.
+ *
+ *   class TenantModel extends Model {}
+ *   TenantModel.addGlobalScope("tenant", (q) => q.where("teamId", currentTeam()));
+ *   class Post extends TenantModel {}     // Post must be scoped too
+ *
+ * Looking only at the concrete class would leave `Post.query()` completely
+ * unconstrained — and a scope that silently does nothing fails *open*, which for
+ * a tenancy scope means returning every customer's rows.
+ *
+ * Walked root-first so a subclass can override an ancestor's scope by reusing its
+ * name — the nearest declaration of a given name wins.
+ */
+function scopesFor(cls) {
+    const chain = [];
+    for (let c = cls; c && c !== Function.prototype; c = Object.getPrototypeOf(c)) {
+        chain.unshift(c);
+    }
+    const merged = new Map();
+    for (const link of chain) {
+        for (const [name, scope] of globalScopes.get(link) ?? [])
+            merged.set(name, scope);
+    }
+    return merged;
+}
 /**
  * Loaded relations live off the model itself so they never leak into `save()`
  * (which spreads own columns) — they're keyed here by the owning instance.
@@ -73,10 +102,13 @@ export class Model {
         map.set(name, scope);
     }
     /** Build this model's base query, applying global scopes and the soft-delete filter. */
-    static baseQuery(trashed = "exclude") {
+    static baseQuery(trashed = "exclude", skip) {
         const query = db(this.table, this.connection);
-        for (const scope of globalScopes.get(this)?.values() ?? [])
-            scope(query);
+        for (const [name, scope] of scopesFor(this)) {
+            if (skip?.has(name))
+                continue;
+            scope(query, this);
+        }
         if (this.softDeletes) {
             if (trashed === "exclude")
                 query.whereNull(this.deletedAtColumn);
@@ -89,6 +121,20 @@ export class Model {
     static query() {
         return this.baseQuery();
     }
+    /**
+     * Drop named global scopes from this query.
+     *
+     * Deliberately explicit and greppable: a query that escapes a tenancy scope is
+     * exactly the thing you want to be able to find at audit time, so it has to be
+     * *typed out*, not arrived at by forgetting something.
+     */
+    static withoutGlobalScope(...names) {
+        return this.baseQuery("exclude", new Set(names));
+    }
+    /** Drop every global scope. Same warning, louder. */
+    static withoutGlobalScopes() {
+        return this.baseQuery("exclude", new Set(scopesFor(this).keys()));
+    }
     /** Include soft-deleted rows (bypasses the soft-delete scope). */
     static withTrashed() {
         return this.baseQuery("with");

package/dist/teams/config.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Teams configuration. Merged under `config("teams")` by the provider; override in
+ * `config/teams.ts` (publish it with `keel vendor:publish --tag teams-config`).
+ */
+export interface TeamsConfig {
+    /** The users table. Teams adds `current_team_id` to it and touches nothing else. */
+    userTable: string;
+    /**
+     * Give every new user a team of their own on signup.
+     *
+     * On by default, and worth leaving on even for an app that feels single-user:
+     * a "personal workspace" is just a team of one, and *adding* tenancy later means
+     * backfilling every table and rewriting every query. Ignoring a team you have is
+     * one unused row; needing a team you don't have is a migration nobody enjoys.
+     */
+    personalTeams: boolean;
+    invitations: {
+        expiresInHours: number;
+        /** Where the emailed link points. `:token` is replaced. */
+        url: string;
+    };
+    mail: {
+        from?: string;
+    };
+}
+export declare const defaultConfig: TeamsConfig;
+export declare function resolveConfig(): TeamsConfig;

package/dist/teams/config.js

@@ -0,0 +1,23 @@
+/**
+ * Teams configuration. Merged under `config("teams")` by the provider; override in
+ * `config/teams.ts` (publish it with `keel vendor:publish --tag teams-config`).
+ */
+import { config } from "../core/helpers.js";
+export const defaultConfig = {
+    userTable: "users",
+    personalTeams: true,
+    invitations: {
+        expiresInHours: 72,
+        url: "/invitations/:token",
+    },
+    mail: {},
+};
+export function resolveConfig() {
+    const raw = config("teams", {});
+    return {
+        userTable: raw.userTable ?? defaultConfig.userTable,
+        personalTeams: raw.personalTeams ?? defaultConfig.personalTeams,
+        invitations: { ...defaultConfig.invitations, ...raw.invitations },
+        mail: { ...defaultConfig.mail, ...raw.mail },
+    };
+}

package/dist/teams/context.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Which team the current work belongs to.
+ *
+ * Carried in `AsyncLocalStorage`, not a module global, so two concurrent requests
+ * can't see each other's team — the same reason Keel carries the request and the
+ * open transaction that way.
+ *
+ * **There is no "no team" fallback.** `currentTeamId()` throws when nothing has set
+ * a team, and `TenantModel`'s scope calls it on every query. That is deliberate, and
+ * it is the whole security model:
+ *
+ *   - Return *unscoped* when there's no team, and every background job silently sees
+ *     every tenant's rows. This is how customer A's invoice reaches customer B.
+ *   - Return `undefined` into the where clause (`teamId = NULL`) and jobs match
+ *     nothing, "work" fine, and quietly do nothing for a month.
+ *   - Throw, and a job that forgot crashes in development instead of leaking in
+ *     production.
+ *
+ * A job, a console command, a webhook, a seeder — none of them run inside a request,
+ * so each one has to say which team it is for:
+ *
+ *   await runForTeam(team, () => sendInvoices());
+ *
+ * ...or say, out loud and greppably, that it isn't for one:
+ *
+ *   await withoutTenant(() => Post.query().get());   // every team's posts
+ */
+export interface TeamContext {
+    /** `null` means "deliberately no tenant" — set by `withoutTenant`. */
+    teamId: string | number | null;
+}
+/** Run `fn` with this team as the current tenant. */
+export declare function runForTeam<T>(team: string | number | {
+    id: string | number;
+}, fn: () => T): T;
+/**
+ * Run `fn` with tenant scoping switched **off**.
+ *
+ * Every use of this is a query that crosses tenant boundaries, so it should be easy
+ * to find and easy to justify. That's the point of making it a named call rather
+ * than something you get by forgetting a `where`.
+ */
+export declare function withoutTenant<T>(fn: () => T): T;
+/** The current team's id, or `undefined` outside any team context. */
+export declare function currentTeam(): string | number | null | undefined;
+/** Is there a team context at all (including a deliberate `withoutTenant`)? */
+export declare function hasTeamContext(): boolean;
+/**
+ * The current team's id — or an error.
+ *
+ * Called by the tenant scope on every query, so this is the thing that turns "I
+ * forgot" into a crash rather than a leak.
+ */
+export declare function currentTeamId(): string | number;

package/dist/teams/context.js

@@ -0,0 +1,73 @@
+/**
+ * Which team the current work belongs to.
+ *
+ * Carried in `AsyncLocalStorage`, not a module global, so two concurrent requests
+ * can't see each other's team — the same reason Keel carries the request and the
+ * open transaction that way.
+ *
+ * **There is no "no team" fallback.** `currentTeamId()` throws when nothing has set
+ * a team, and `TenantModel`'s scope calls it on every query. That is deliberate, and
+ * it is the whole security model:
+ *
+ *   - Return *unscoped* when there's no team, and every background job silently sees
+ *     every tenant's rows. This is how customer A's invoice reaches customer B.
+ *   - Return `undefined` into the where clause (`teamId = NULL`) and jobs match
+ *     nothing, "work" fine, and quietly do nothing for a month.
+ *   - Throw, and a job that forgot crashes in development instead of leaking in
+ *     production.
+ *
+ * A job, a console command, a webhook, a seeder — none of them run inside a request,
+ * so each one has to say which team it is for:
+ *
+ *   await runForTeam(team, () => sendInvoices());
+ *
+ * ...or say, out loud and greppably, that it isn't for one:
+ *
+ *   await withoutTenant(() => Post.query().get());   // every team's posts
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+const storage = new AsyncLocalStorage();
+/** Run `fn` with this team as the current tenant. */
+export function runForTeam(team, fn) {
+    const teamId = typeof team === "object" ? team.id : team;
+    return storage.run({ teamId }, fn);
+}
+/**
+ * Run `fn` with tenant scoping switched **off**.
+ *
+ * Every use of this is a query that crosses tenant boundaries, so it should be easy
+ * to find and easy to justify. That's the point of making it a named call rather
+ * than something you get by forgetting a `where`.
+ */
+export function withoutTenant(fn) {
+    return storage.run({ teamId: null }, fn);
+}
+/** The current team's id, or `undefined` outside any team context. */
+export function currentTeam() {
+    return storage.getStore()?.teamId;
+}
+/** Is there a team context at all (including a deliberate `withoutTenant`)? */
+export function hasTeamContext() {
+    return storage.getStore() !== undefined;
+}
+/**
+ * The current team's id — or an error.
+ *
+ * Called by the tenant scope on every query, so this is the thing that turns "I
+ * forgot" into a crash rather than a leak.
+ */
+export function currentTeamId() {
+    const store = storage.getStore();
+    if (!store) {
+        throw new Error("No team in context, so a tenant-scoped query can't be built safely.\n" +
+            "Inside a request, add teamContext() to your middleware.\n" +
+            "In a job, command, or seeder, wrap the work: runForTeam(team, () => …).\n" +
+            "If it genuinely spans every team, say so: withoutTenant(() => …).");
+    }
+    if (store.teamId === null) {
+        // withoutTenant() — the caller has already said this query crosses tenants, and
+        // the scope is skipped before it ever asks for an id.
+        throw new Error("currentTeamId() called inside withoutTenant().");
+    }
+    return store.teamId;
+}

package/dist/teams/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Keel Teams — multi-tenancy, membership, roles, invitations.
+ * Imported from `@shaferllc/keel/teams`.
+ *
+ *   class Post extends TenantModel { static table = "posts"; }
+ *   await Post.all();   // only the current team's posts. Always.
+ *
+ * Isolation is deny-by-default: a `TenantModel` query outside a team context
+ * **throws** rather than quietly returning everything. Crossing tenants is possible,
+ * but only by saying so — `withoutTenant(() => …)` — which is a thing you can grep
+ * for at audit time. See context.ts for why the alternatives are worse.
+ */
+export { TeamsServiceProvider } from "./provider.js";
+export { TenantModel, TENANT_SCOPE } from "./tenant.js";
+export { currentTeam, currentTeamId, hasTeamContext, runForTeam, withoutTenant, } from "./context.js";
+export type { TeamContext } from "./context.js";
+export { Team, Membership, ROLES, createTeam, memberOf, roleAtLeast, roleOf, switchTeam, teamsFor, } from "./models.js";
+export type { Role } from "./models.js";
+export { acceptInvitation, invite, pendingInvitations, revokeInvitation, } from "./invitations.js";
+export type { Invitation, SentInvitation } from "./invitations.js";
+export { requireRole, teamContext } from "./middleware.js";
+export type { TeamContextOptions } from "./middleware.js";
+export { teamsMigration } from "./migration.js";
+export { defaultConfig, resolveConfig } from "./config.js";
+export type { TeamsConfig } from "./config.js";

package/dist/teams/index.js

@@ -0,0 +1,20 @@
+/**
+ * Keel Teams — multi-tenancy, membership, roles, invitations.
+ * Imported from `@shaferllc/keel/teams`.
+ *
+ *   class Post extends TenantModel { static table = "posts"; }
+ *   await Post.all();   // only the current team's posts. Always.
+ *
+ * Isolation is deny-by-default: a `TenantModel` query outside a team context
+ * **throws** rather than quietly returning everything. Crossing tenants is possible,
+ * but only by saying so — `withoutTenant(() => …)` — which is a thing you can grep
+ * for at audit time. See context.ts for why the alternatives are worse.
+ */
+export { TeamsServiceProvider } from "./provider.js";
+export { TenantModel, TENANT_SCOPE } from "./tenant.js";
+export { currentTeam, currentTeamId, hasTeamContext, runForTeam, withoutTenant, } from "./context.js";
+export { Team, Membership, ROLES, createTeam, memberOf, roleAtLeast, roleOf, switchTeam, teamsFor, } from "./models.js";
+export { acceptInvitation, invite, pendingInvitations, revokeInvitation, } from "./invitations.js";
+export { requireRole, teamContext } from "./middleware.js";
+export { teamsMigration } from "./migration.js";
+export { defaultConfig, resolveConfig } from "./config.js";

package/dist/teams/invitations.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Team invitations.
+ *
+ * Unlike password reset, an invitation **is** a database row — because it has to be
+ * listable ("3 pending invites") and revocable, and you can't revoke a stateless
+ * token. What isn't stored is the token itself: only its hash, so a leaked database
+ * doesn't let someone walk into every pending team.
+ *
+ * The email is baked into the invitation and re-checked on accept, so a forwarded
+ * link doesn't let a different person join in the invitee's place.
+ */
+import { Team, type Role } from "./models.js";
+export interface Invitation {
+    id: number;
+    team_id: number;
+    email: string;
+    role: Role;
+    expires_at: string;
+}
+export interface SentInvitation {
+    invitation: Invitation;
+    /** The plaintext token — it goes in the email and is never stored. */
+    token: string;
+}
+/** Invite someone to a team. Returns the token so a caller can build its own link. */
+export declare function invite(teamId: string | number, email: string, role?: Role): Promise<SentInvitation>;
+/** Outstanding invitations for a team. */
+export declare function pendingInvitations(teamId: string | number): Promise<Invitation[]>;
+/** Withdraw an invitation. */
+export declare function revokeInvitation(id: string | number): Promise<void>;
+/**
+ * Accept an invitation, joining the team.
+ *
+ * `email` is the address of the person actually accepting — it must match the one
+ * invited. Otherwise a forwarded link lets anyone join a team they were never asked
+ * to, which is the interesting attack on an invitation system.
+ */
+export declare function acceptInvitation(token: string, userId: string | number, email: string): Promise<Team | null>;

package/dist/teams/invitations.js

@@ -0,0 +1,123 @@
+/**
+ * Team invitations.
+ *
+ * Unlike password reset, an invitation **is** a database row — because it has to be
+ * listable ("3 pending invites") and revocable, and you can't revoke a stateless
+ * token. What isn't stored is the token itself: only its hash, so a leaked database
+ * doesn't let someone walk into every pending team.
+ *
+ * The email is baked into the invitation and re-checked on accept, so a forwarded
+ * link doesn't let a different person join in the invitee's place.
+ */
+import { db } from "../core/database.js";
+import { hash } from "../core/crypto.js";
+import { config } from "../core/helpers.js";
+import { mail } from "../core/mail.js";
+import { Membership, Team } from "./models.js";
+import { resolveConfig } from "./config.js";
+/** Invite someone to a team. Returns the token so a caller can build its own link. */
+export async function invite(teamId, email, role = "member") {
+    const settings = resolveConfig();
+    const address = email.toLowerCase();
+    // Re-inviting replaces the outstanding invitation rather than stacking duplicates.
+    await db("team_invitations").where("team_id", teamId).where("email", address).delete();
+    const token = randomToken();
+    const expires = new Date(Date.now() + settings.invitations.expiresInHours * 3_600_000);
+    const id = await db("team_invitations").insertGetId({
+        team_id: teamId,
+        email: address,
+        role,
+        // Only the hash. The token exists in the email and nowhere else.
+        token: await hash.make(token),
+        expires_at: expires.toISOString(),
+        created_at: new Date().toISOString(),
+    });
+    const invitation = {
+        id: Number(id),
+        team_id: Number(teamId),
+        email: address,
+        role,
+        expires_at: expires.toISOString(),
+    };
+    await sendInvitationEmail(invitation, token);
+    return { invitation, token };
+}
+/** Outstanding invitations for a team. */
+export async function pendingInvitations(teamId) {
+    const rows = await db("team_invitations").where("team_id", teamId).get();
+    return rows.map(toInvitation);
+}
+/** Withdraw an invitation. */
+export async function revokeInvitation(id) {
+    await db("team_invitations").where("id", id).delete();
+}
+/**
+ * Accept an invitation, joining the team.
+ *
+ * `email` is the address of the person actually accepting — it must match the one
+ * invited. Otherwise a forwarded link lets anyone join a team they were never asked
+ * to, which is the interesting attack on an invitation system.
+ */
+export async function acceptInvitation(token, userId, email) {
+    const address = email.toLowerCase();
+    const rows = await db("team_invitations").where("email", address).get();
+    for (const row of rows) {
+        if (!(await hash.verify(String(row.token), token)))
+            continue;
+        // Expired invitations are dead, and worth clearing out while we're here.
+        if (new Date(String(row.expires_at)) < new Date()) {
+            await db("team_invitations").where("id", row.id).delete();
+            return null;
+        }
+        const existing = await db(Membership.table)
+            .where("team_id", row.team_id)
+            .where("user_id", userId)
+            .first();
+        if (!existing) {
+            await Membership.create({
+                team_id: row.team_id,
+                user_id: userId,
+                role: row.role,
+            });
+        }
+        // Single use.
+        await db("team_invitations").where("id", row.id).delete();
+        const team = await db(Team.table).where("id", row.team_id).first();
+        return team ? new Team(team) : null;
+    }
+    return null;
+}
+/* --------------------------------- internals ------------------------------ */
+async function sendInvitationEmail(invitation, token) {
+    const settings = resolveConfig();
+    const team = await db(Team.table).where("id", invitation.team_id).first();
+    const link = absolute(settings.invitations.url.replace(":token", encodeURIComponent(token)));
+    const message = mail()
+        .to(invitation.email)
+        .subject(`You've been invited to ${team?.name ?? "a team"}`)
+        .html(`<p>You've been invited to join <strong>${team?.name ?? "a team"}</strong>.</p>` +
+        `<p><a href="${link}">Accept the invitation</a></p>` +
+        `<p>It expires in ${settings.invitations.expiresInHours} hours.</p>`);
+    if (settings.mail.from)
+        message.from(settings.mail.from);
+    await message.send();
+}
+function randomToken() {
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function toInvitation(row) {
+    return {
+        id: Number(row.id),
+        team_id: Number(row.team_id),
+        email: String(row.email),
+        role: row.role,
+        expires_at: String(row.expires_at),
+    };
+}
+function absolute(url) {
+    if (/^https?:\/\//i.test(url))
+        return url;
+    const base = config("app.url", "http://localhost:3000").replace(/\/$/, "");
+    return `${base}${url.startsWith("/") ? "" : "/"}${url}`;
+}

package/dist/teams/middleware.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Putting a request inside a team.
+ *
+ * `teamContext()` resolves which team the signed-in user is acting as and runs the
+ * rest of the request inside it, so every `TenantModel` query is scoped without any
+ * handler doing anything.
+ *
+ * The membership check is the security boundary. `users.current_team_id` is just a
+ * number on a row the user can influence, so it is **verified against a membership**
+ * on every request — not trusted. Otherwise switching teams is a matter of writing a
+ * different id, and tenancy is decoration.
+ */
+import type { MiddlewareHandler } from "hono";
+import { type Role } from "./models.js";
+export interface TeamContextOptions {
+    /**
+     * What to do when a signed-in user has no team at all. `"error"` throws;
+     * `"pass"` continues with no team context (so any TenantModel query will throw —
+     * which is the right outcome for a route that shouldn't have needed one).
+     */
+    onMissing?: "error" | "pass";
+}
+/** Resolve the acting team and run the request inside it. */
+export declare function teamContext(options?: TeamContextOptions): MiddlewareHandler;
+/**
+ * Require at least this role in the current team.
+ *
+ *   router.delete("/posts/:post", …).middleware(requireRole("admin"))
+ */
+export declare function requireRole(role?: Role): MiddlewareHandler;

package/dist/teams/middleware.js

@@ -0,0 +1,92 @@
+/**
+ * Putting a request inside a team.
+ *
+ * `teamContext()` resolves which team the signed-in user is acting as and runs the
+ * rest of the request inside it, so every `TenantModel` query is scoped without any
+ * handler doing anything.
+ *
+ * The membership check is the security boundary. `users.current_team_id` is just a
+ * number on a row the user can influence, so it is **verified against a membership**
+ * on every request — not trusted. Otherwise switching teams is a matter of writing a
+ * different id, and tenancy is decoration.
+ */
+import { auth } from "../core/auth.js";
+import { db } from "../core/database.js";
+import { ForbiddenException } from "../core/exceptions.js";
+import { runForTeam, withoutTenant } from "./context.js";
+import { Membership, roleOf, teamsFor } from "./models.js";
+import { resolveConfig } from "./config.js";
+/** Resolve the acting team and run the request inside it. */
+export function teamContext(options = {}) {
+    return async (c, next) => {
+        const userId = auth().id();
+        if (!userId) {
+            // Nobody's signed in: no team, and no guessing. A tenant-scoped query on this
+            // request will throw, which is what we want it to do.
+            await next();
+            return;
+        }
+        const teamId = await resolveTeam(userId);
+        if (teamId === null) {
+            if (options.onMissing === "error") {
+                throw new ForbiddenException("You don't belong to any team.");
+            }
+            await next();
+            return;
+        }
+        c.set("team_id", teamId);
+        await runForTeam(teamId, () => next());
+    };
+}
+/**
+ * Require at least this role in the current team.
+ *
+ *   router.delete("/posts/:post", …).middleware(requireRole("admin"))
+ */
+export function requireRole(role = "member") {
+    return async (c, next) => {
+        const userId = auth().id();
+        const teamId = c.get("team_id");
+        if (!userId || !teamId)
+            throw new ForbiddenException("You don't belong to this team.");
+        const actual = await withoutTenant(() => roleOf(userId, teamId));
+        if (!actual)
+            throw new ForbiddenException("You don't belong to this team.");
+        const { roleAtLeast } = await import("./models.js");
+        if (!roleAtLeast(actual, role)) {
+            throw new ForbiddenException(`This needs the ${role} role.`);
+        }
+        await next();
+    };
+}
+/* --------------------------------- internals ------------------------------ */
+/**
+ * The team this user is acting as — verified, not trusted.
+ *
+ * Reads `current_team_id`, then confirms a membership actually exists. If it doesn't
+ * (they were removed, or the id was tampered with), it falls back to a team they are
+ * genuinely in rather than honouring the number on the row.
+ */
+async function resolveTeam(userId) {
+    const settings = resolveConfig();
+    // These lookups are *about* teams, so they must not themselves be tenant-scoped.
+    return withoutTenant(async () => {
+        const user = await db(settings.userTable).where("id", userId).first();
+        const current = user?.current_team_id;
+        if (current != null) {
+            const membership = await db(Membership.table)
+                .where("user_id", userId)
+                .where("team_id", current)
+                .first();
+            if (membership)
+                return current;
+            // Stale or forged: fall through and pick a team they're really in.
+        }
+        const teams = await teamsFor(userId);
+        if (!teams.length)
+            return null;
+        const first = teams[0].id;
+        await db(settings.userTable).where("id", userId).update({ current_team_id: first });
+        return first;
+    });
+}