@substrat-run/vertical-auth 0.19.1 → 0.20.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/identity-do.d.ts +9 -8
- package/dist/identity-do.d.ts.map +1 -1
- package/dist/identity-do.js +18 -27
- package/dist/identity-do.js.map +1 -1
- package/dist/invite-routes.d.ts +71 -13
- package/dist/invite-routes.d.ts.map +1 -1
- package/dist/invite-routes.js +89 -51
- package/dist/invite-routes.js.map +1 -1
- package/dist/member-directory.d.ts +52 -0
- package/dist/member-directory.d.ts.map +1 -0
- package/dist/member-directory.js +69 -0
- package/dist/member-directory.js.map +1 -0
- package/package.json +8 -4
package/dist/identity-do.d.ts
CHANGED
|
@@ -2,6 +2,8 @@ import { DurableObject } from 'cloudflare:workers';
|
|
|
2
2
|
import type { AuthProvider } from './provider.js';
|
|
3
3
|
import { type SiteRow } from './site-registry.js';
|
|
4
4
|
import { type OwnerClaimLinkRow, type OwnerSeat, type OwnerTransfer, type OwnerTransferAbandon } from './owner-seat.js';
|
|
5
|
+
import { type InviteRow, type MemberBinding } from './member-directory.js';
|
|
6
|
+
export type { InviteRow, MemberBinding } from './member-directory.js';
|
|
5
7
|
export type IdentityDoEnv = Record<string, never>;
|
|
6
8
|
export declare class IdentityDO extends DurableObject<IdentityDoEnv> {
|
|
7
9
|
/** This tenant's Better Auth signing secret — generated in this DO, never shared, never a worker binding. */
|
|
@@ -155,6 +157,12 @@ export declare class IdentityDO extends DurableObject<IdentityDoEnv> {
|
|
|
155
157
|
unbindPrincipal(scopeId: string, principal: string): Promise<string[]>;
|
|
156
158
|
/** The subjects bound in this scope, at most `limit` — the whole set a places repair sends. */
|
|
157
159
|
subjectsOf(scopeId: string, limit: number): Promise<string[]>;
|
|
160
|
+
/**
|
|
161
|
+
* Who this directory knows at the scope, by principal (#1150): how many subjects are bound to
|
|
162
|
+
* each, and the address an invite to it named — the identity half of the dashboard's member
|
|
163
|
+
* roster. The role half is the scope's own (`listScopeRoleHolders`). One scope, never a walk.
|
|
164
|
+
*/
|
|
165
|
+
listMemberBindings(scopeId: string): Promise<MemberBinding[]>;
|
|
158
166
|
/** A Better Auth instance over THIS DO's SQLite, trusting the caller's origin. */
|
|
159
167
|
private auth;
|
|
160
168
|
/**
|
|
@@ -169,13 +177,6 @@ export declare class IdentityDO extends DurableObject<IdentityDoEnv> {
|
|
|
169
177
|
*/
|
|
170
178
|
fetch(request: Request): Promise<Response>;
|
|
171
179
|
}
|
|
172
|
-
/** An outstanding invite as the directory returns it — never its token. */
|
|
173
|
-
export type InviteRow = {
|
|
174
|
-
principal: string;
|
|
175
|
-
roleKey: string;
|
|
176
|
-
email: string | null;
|
|
177
|
-
createdAt: number;
|
|
178
|
-
};
|
|
179
180
|
/** A minimal stub shape — the identity DO's callable surface (avoids leaking the full class type). */
|
|
180
181
|
export type IdentityStub = {
|
|
181
182
|
fetch(request: Request): Promise<Response>;
|
|
@@ -216,6 +217,7 @@ export type IdentityStub = {
|
|
|
216
217
|
unbind(scopeId: string, sub: string): Promise<boolean>;
|
|
217
218
|
unbindPrincipal(scopeId: string, principal: string): Promise<string[]>;
|
|
218
219
|
subjectsOf(scopeId: string, limit: number): Promise<string[]>;
|
|
220
|
+
listMemberBindings(scopeId: string): Promise<MemberBinding[]>;
|
|
219
221
|
};
|
|
220
222
|
type _StubCarriesClass = IdentityDO extends IdentityStub ? true : never;
|
|
221
223
|
type _ClassMethodsMissingFromStub = Exclude<keyof IdentityDO, keyof DurableObject | keyof IdentityStub>;
|
|
@@ -232,5 +234,4 @@ export declare function doAuthProvider(stub: Pick<IdentityStub, 'fetch'>, origin
|
|
|
232
234
|
cookieDomain?: string;
|
|
233
235
|
platformBaseDomains?: readonly string[];
|
|
234
236
|
}): AuthProvider;
|
|
235
|
-
export {};
|
|
236
237
|
//# sourceMappingURL=identity-do.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"identity-do.d.ts","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKnD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAG/D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAaL,KAAK,iBAAiB,EAOtB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"identity-do.d.ts","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKnD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAG/D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAaL,KAAK,iBAAiB,EAOtB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EASL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AA4EtE,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,qBAAa,UAAW,SAAQ,aAAa,CAAC,aAAa,CAAC;IAC1D,6GAA6G;IAC7G,OAAO,CAAC,UAAU,CAAU;IAE5B,YAAY,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa,EAmBtD;IAED;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnG;IAED;;;;;;;OAOG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAMrE;IAED;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CASpG;IAED;;;;;OAKG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;IAED,uFAAuF;IACjF,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAED,0EAA0E;IACpE,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAEpC;IAED;;;;;OAKG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3D;IAED,oFAAoF;IACpF,OAAO,KAAK,WAAW,GAEtB;IAED;;;;;OAKG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;IAED;;;;OAIG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE9D;IAED;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAE3G;IAED,kGAAkG;IAC5F,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF;IAED,iFAAiF;IAC3E,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAEzH;IAED;;;;OAIG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElD;IAED,iHAAiH;IAC3G,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAEnD;IAED;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3E;IAED;;;OAGG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE9D;IAED;;;;OAIG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAE/H;IAED,iGAAiG;IAC3F,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE5E;IAED;;;OAGG;IACG,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE1H;IAED;;;OAGG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExF;IAED;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9H;IAED,oGAAoG;IAC9F,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAEvD;IAED;;;OAGG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE7E;IAED,qGAAqG;IAC/F,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvE;IAED,0FAA0F;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE;IAED;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEzF;IAED;;;OAGG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3D;IAED;+FAC2F;IACrF,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE3E;IAED,+FAA+F;IACzF,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAElE;IAED;;;;OAIG;IACG,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAElE;IAED,kFAAkF;IAClF,OAAO,CAAC,IAAI;IAkBZ;;;;;;;;;OASG;IACY,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCxD;CACF;AAED,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACvG,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC3H,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1H,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAC/D,CAAC;AAKF,KAAK,iBAAiB,GAAG,UAAU,SAAS,YAAY,GAAG,IAAI,GAAG,KAAK,CAAC;AACxE,KAAK,4BAA4B,GAAG,OAAO,CAAC,MAAM,UAAU,EAAE,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,CAAC;AACxG,eAAO,MAAM,gBAAgB,EAAE,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,KAAY,CAAC;AAE7H;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACxE,YAAY,CASd"}
|
package/dist/identity-do.js
CHANGED
|
@@ -7,6 +7,7 @@ import { cookieDomainDecision, expireBetterAuthDomainCookies, forwardIdentityCoo
|
|
|
7
7
|
import { parsePlatformBaseDomains } from '@substrat-run/contracts';
|
|
8
8
|
import { SITE_REGISTRY_DDL, recordSite as recordSiteRow, listSites as listSiteRows, resolveSiteScope as resolveSiteScopeRow, forgetSite as forgetSiteRow, } from './site-registry.js';
|
|
9
9
|
import { OWNER_SEAT_DDL, migrateOwnerSeat, recordOwnerSeat, ownerOfRecord as ownerOfRecordRow, needsSetup as needsSetupRow, ownerSeat as ownerSeatRow, resolvePrincipal as resolvePrincipalRow, ownerClaimTarget as ownerClaimTargetRow, recordOwnerClaim as recordOwnerClaimRow, ownerClaimMatches as ownerClaimMatchesRow, claimOwnerByCapability as claimOwnerByCapabilityRow, claimOwner as claimOwnerRow, unbindSubject as unbindSubjectRow, unbindPrincipal as unbindPrincipalRow, subjectsOf as subjectsOfRows, transferOwner as transferOwnerRow, completeOwnerTransfer as completeOwnerTransferRow, abandonOwnerTransfer as abandonOwnerTransferRow, } from './owner-seat.js';
|
|
10
|
+
import { INVITE_DDL, createInvite as createInviteRow, listInvites as listInviteRows, getInvite as getInviteRow, inviteExists as inviteExistsRow, revokeInvite as revokeInviteRow, claimInvite as claimInviteRow, listMemberBindings as listMemberBindingRows, } from './member-directory.js';
|
|
10
11
|
/**
|
|
11
12
|
* The per-tenant IDENTITY Durable Object — one per tenant, running its OWN Better Auth
|
|
12
13
|
* over its OWN SQLite (Drizzle's Durable-Object driver, not a shared D1), and holding the
|
|
@@ -60,14 +61,9 @@ const SCHEMA_STATEMENTS = [
|
|
|
60
61
|
// the rules over them live in `owner-seat.ts` so they are unit-tested without a DO; the
|
|
61
62
|
// methods below delegate there.
|
|
62
63
|
...OWNER_SEAT_DDL,
|
|
63
|
-
// Outstanding member invites (the post-setup join path)
|
|
64
|
-
//
|
|
65
|
-
|
|
66
|
-
`CREATE TABLE IF NOT EXISTS invite (
|
|
67
|
-
token_hash TEXT PRIMARY KEY, scope_id TEXT NOT NULL, principal TEXT NOT NULL,
|
|
68
|
-
role_key TEXT NOT NULL, email TEXT, claimed INTEGER NOT NULL DEFAULT 0,
|
|
69
|
-
created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)))`,
|
|
70
|
-
`CREATE INDEX IF NOT EXISTS invite_by_scope ON invite (scope_id)`,
|
|
64
|
+
// Outstanding member invites (the post-setup join path) — the table and its rows are in
|
|
65
|
+
// `member-directory.ts`, tested there without a DO.
|
|
66
|
+
...INVITE_DDL,
|
|
71
67
|
// This DO's own config — notably its session-signing secret, generated here per tenant.
|
|
72
68
|
`CREATE TABLE IF NOT EXISTS config (key TEXT PRIMARY KEY, value TEXT NOT NULL)`,
|
|
73
69
|
// PER-SCOPE instance config, delivered by the platform via /internal/configure
|
|
@@ -274,28 +270,26 @@ export class IdentityDO extends DurableObject {
|
|
|
274
270
|
* The plaintext token never reaches the DO — only its hash, so a DB read can't mint access.
|
|
275
271
|
*/
|
|
276
272
|
async createInvite(scopeId, principal, roleKey, email, tokenHash) {
|
|
277
|
-
this.
|
|
273
|
+
createInviteRow(this.registrySql, scopeId, principal, roleKey, email, tokenHash);
|
|
278
274
|
}
|
|
279
275
|
/** The scope's outstanding (unclaimed) invites — for the admin's pending-invites list. No token. */
|
|
280
276
|
async listInvites(scopeId) {
|
|
281
|
-
return
|
|
277
|
+
return listInviteRows(this.registrySql, scopeId);
|
|
282
278
|
}
|
|
283
279
|
/**
|
|
284
280
|
* One outstanding (unclaimed) invite by its pre-minted principal, or null (#1931). What the
|
|
285
281
|
* revoke route reads first: the role an invite confers is the role its removal is bounded by.
|
|
286
282
|
*/
|
|
287
283
|
async getInvite(scopeId, principal) {
|
|
288
|
-
|
|
289
|
-
return r ? inviteRowOf(r) : null;
|
|
284
|
+
return getInviteRow(this.registrySql, scopeId, principal);
|
|
290
285
|
}
|
|
291
286
|
/** Is there an unclaimed invite for this token hash? (the sign-up gate consults this post-setup). */
|
|
292
287
|
async inviteExists(scopeId, tokenHash) {
|
|
293
|
-
|
|
294
|
-
return r !== undefined;
|
|
288
|
+
return inviteExistsRow(this.registrySql, scopeId, tokenHash);
|
|
295
289
|
}
|
|
296
290
|
/** Withdraw an unclaimed invite by its (pre-minted) principal — the id the admin sees. */
|
|
297
291
|
async revokeInvite(scopeId, principal) {
|
|
298
|
-
this.
|
|
292
|
+
revokeInviteRow(this.registrySql, scopeId, principal);
|
|
299
293
|
}
|
|
300
294
|
/**
|
|
301
295
|
* Claim an invite: bind this verified subject to the invite's pre-minted principal and
|
|
@@ -304,12 +298,7 @@ export class IdentityDO extends DurableObject {
|
|
|
304
298
|
* bound principal resolves its permissions immediately.
|
|
305
299
|
*/
|
|
306
300
|
async claimInvite(scopeId, sub, tokenHash) {
|
|
307
|
-
|
|
308
|
-
if (!inv)
|
|
309
|
-
return null;
|
|
310
|
-
this.ctx.storage.sql.exec('INSERT OR REPLACE INTO identity (scope_id, sub, principal) VALUES (?, ?, ?)', scopeId, sub, inv.principal);
|
|
311
|
-
this.ctx.storage.sql.exec('UPDATE invite SET claimed = 1 WHERE scope_id = ? AND token_hash = ?', scopeId, tokenHash);
|
|
312
|
-
return inv.principal;
|
|
301
|
+
return claimInviteRow(this.registrySql, scopeId, sub, tokenHash);
|
|
313
302
|
}
|
|
314
303
|
/**
|
|
315
304
|
* Unbind a subject from this scope — the removal half of the directory (#1670). True when a
|
|
@@ -327,6 +316,14 @@ export class IdentityDO extends DurableObject {
|
|
|
327
316
|
async subjectsOf(scopeId, limit) {
|
|
328
317
|
return subjectsOfRows(this.registrySql, scopeId, limit);
|
|
329
318
|
}
|
|
319
|
+
/**
|
|
320
|
+
* Who this directory knows at the scope, by principal (#1150): how many subjects are bound to
|
|
321
|
+
* each, and the address an invite to it named — the identity half of the dashboard's member
|
|
322
|
+
* roster. The role half is the scope's own (`listScopeRoleHolders`). One scope, never a walk.
|
|
323
|
+
*/
|
|
324
|
+
async listMemberBindings(scopeId) {
|
|
325
|
+
return listMemberBindingRows(this.registrySql, scopeId);
|
|
326
|
+
}
|
|
330
327
|
/** A Better Auth instance over THIS DO's SQLite, trusting the caller's origin. */
|
|
331
328
|
auth(origin, cookieDomain, rejectOldDomainSession = false) {
|
|
332
329
|
const db = drizzle(this.ctx.storage, { schema });
|
|
@@ -388,12 +385,6 @@ export class IdentityDO extends DurableObject {
|
|
|
388
385
|
return withCleanup(await auth.handler(request));
|
|
389
386
|
}
|
|
390
387
|
}
|
|
391
|
-
const inviteRowOf = (r) => ({
|
|
392
|
-
principal: r.principal,
|
|
393
|
-
roleKey: r.role_key,
|
|
394
|
-
email: r.email ?? null,
|
|
395
|
-
createdAt: r.created_at,
|
|
396
|
-
});
|
|
397
388
|
export const _identityStubPin = true;
|
|
398
389
|
/**
|
|
399
390
|
* The `AuthProvider` backed by a tenant's identity-DO stub (the `better-auth-do` config).
|
package/dist/identity-do.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"identity-do.js","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,UAAU,IAAI,aAAa,GAG5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,aAAa,IAAI,gBAAgB,EACjC,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,IAAI,mBAAmB,EACvC,iBAAiB,IAAI,oBAAoB,EACzC,sBAAsB,IAAI,yBAAyB,EACnD,UAAU,IAAI,aAAa,EAE3B,aAAa,IAAI,gBAAgB,EACjC,eAAe,IAAI,kBAAkB,EACrC,UAAU,IAAI,cAAc,EAC5B,aAAa,IAAI,gBAAgB,EACjC,qBAAqB,IAAI,wBAAwB,EACjD,oBAAoB,IAAI,uBAAuB,GAIhD,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,iBAAiB,GAAa;IAClC;;;;0FAIwF;IACxF;;;;iEAI+D;IAC/D,oEAAoE;IACpE;;;;;;iCAM+B;IAC/B,oEAAoE;IACpE;;;0FAGwF;IACxF,qFAAqF;IACrF,wFAAwF;IACxF,4FAA4F;IAC5F,mFAAmF;IACnF,uFAAuF;IACvF,4FAA4F;IAC5F,oFAAoF;IACpF,4FAA4F;IAC5F,4FAA4F;IAC5F,wFAAwF;IACxF,gCAAgC;IAChC,GAAG,cAAc;IACjB,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F;;;0FAGwF;IACxF,iEAAiE;IACjE,wFAAwF;IACxF,+EAA+E;IAC/E,+EAA+E;IAC/E,sFAAsF;IACtF,wFAAwF;IACxF,mDAAmD;IACnD,uIAAuI;IACvI,8FAA8F;IAC9F,yFAAyF;IACzF,wFAAwF;IACxF,yFAAyF;IACzF,mFAAmF;IACnF,GAAG,iBAAiB;CACrB,CAAC;AAMF,MAAM,OAAO,UAAW,SAAQ,aAA4B;IAC1D,6GAA6G;IACrG,UAAU,CAAU;IAE5B,YAAY,GAAuB,EAAE,GAAkB;QACrD,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,KAAK,MAAM,IAAI,IAAI,iBAAiB;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,oFAAoF;YACpF,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC,CAAC;YAC5D,sFAAsF;YACtF,qFAAqF;YACrF,mFAAmF;YACnF,2EAA2E;YAC3E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC,CAAkC,CAAC;YAChI,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,OAA8C;QAClF,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,6EAA6E,EAC7E,OAAO,EAAE,GAAG,EAAE,KAAK,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,GAAG,CAAC,GAAa,CAAC,GAAG,GAAG,CAAC,KAAe,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,GAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC,CAAC,CAAmC,EAAE,KAAK,CAAC;QAClJ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE,MAAM,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;QAC1D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,oFAAoF;IACpF,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACjF,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU;QACnE,OAAO,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACxF,OAAO,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,GAAW;QACjD,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAuB;QAChF,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,SAAiB;QACxD,OAAO,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAAe,EAAE,GAAW,EAAE,YAAoB,EAAE,SAAiB;QAChG,OAAO,yBAAyB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC9D,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAoB,EAAE,SAAiB;QAC7G,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,8FAA8F,EAC9F,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAC9C,CAAC;IACJ,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAClC,uHAAuH,EACvH,OAAO,CACR,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,SAAiB;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACrC,gHAAgH,EAChH,OAAO,EAAE,SAAS,CACnB,CAAC,CAAC,CAAC,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,4EAA4E,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9I,OAAO,CAAC,KAAK,SAAS,CAAC;IACzB,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3H,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC/D,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oFAAoF,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAEzI,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACtI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACrH,OAAO,GAAG,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAW;QACvC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED;+FAC2F;IAC3F,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,KAAa;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,kFAAkF;IAC1E,IAAI,CAAC,MAAc,EAAE,YAA4B,EAAE,sBAAsB,GAAG,KAAK;QACvF,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5D,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE;YAC3E,qFAAqF;YACrF,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;YAC/F,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,iFAAiF;YACjF,oFAAoF;YACpF,sFAAsF;YACtF,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;gBAClF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,KAAK,CAAC,OAAgB;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAClE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,SAAS,EAC5D,GAAG,CAAC,QAAQ,EACZ,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAClF,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,8EAA8E;YAC9E,8EAA8E;YAC9E,uDAAuD;YACvD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAC1C,+DAA+D,CAChE,CAAC,CAAC,CAAC,CAAkC,CAAC;YACvC,IAAI,MAAM,EAAE,KAAK,KAAK,aAAa,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,iFAAiF,EAAE,aAAa,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,CAAC,QAAkB,EAAY,EAAE,CACnD,6BAA6B,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,OAAO,GAAuB,OAAO,EAAE,IAAI;gBAC/C,CAAC,CAAC;oBACE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;oBACpB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;oBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI;oBAC/B,oEAAoE;oBACpE,6EAA6E;oBAC7E,sCAAsC;oBACtC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;iBAC1C;gBACH,CAAC,CAAC,IAAI,CAAC;YACT,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;CACF;AAKD,MAAM,WAAW,GAAG,CAAC,CAAkC,EAAa,EAAE,CAAC,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,SAAmB;IAChC,OAAO,EAAE,CAAC,CAAC,QAAkB;IAC7B,KAAK,EAAG,CAAC,CAAC,KAAuB,IAAI,IAAI;IACzC,SAAS,EAAE,CAAC,CAAC,UAAoB;CAClC,CAAC,CAAC;AAyCH,MAAM,CAAC,MAAM,gBAAgB,GAA2F,IAAI,CAAC;AAE7H;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAiC,EACjC,MAAc,EACd,IAAyE;IAEzE,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAW,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1F,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACvF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"identity-do.js","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,UAAU,IAAI,aAAa,GAG5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,aAAa,IAAI,gBAAgB,EACjC,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,IAAI,mBAAmB,EACvC,iBAAiB,IAAI,oBAAoB,EACzC,sBAAsB,IAAI,yBAAyB,EACnD,UAAU,IAAI,aAAa,EAE3B,aAAa,IAAI,gBAAgB,EACjC,eAAe,IAAI,kBAAkB,EACrC,UAAU,IAAI,cAAc,EAC5B,aAAa,IAAI,gBAAgB,EACjC,qBAAqB,IAAI,wBAAwB,EACjD,oBAAoB,IAAI,uBAAuB,GAIhD,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,UAAU,EACV,YAAY,IAAI,eAAe,EAC/B,WAAW,IAAI,cAAc,EAC7B,SAAS,IAAI,YAAY,EACzB,YAAY,IAAI,eAAe,EAC/B,YAAY,IAAI,eAAe,EAC/B,WAAW,IAAI,cAAc,EAC7B,kBAAkB,IAAI,qBAAqB,GAG5C,MAAM,uBAAuB,CAAC;AAG/B;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,iBAAiB,GAAa;IAClC;;;;0FAIwF;IACxF;;;;iEAI+D;IAC/D,oEAAoE;IACpE;;;;;;iCAM+B;IAC/B,oEAAoE;IACpE;;;0FAGwF;IACxF,qFAAqF;IACrF,wFAAwF;IACxF,4FAA4F;IAC5F,mFAAmF;IACnF,uFAAuF;IACvF,4FAA4F;IAC5F,oFAAoF;IACpF,4FAA4F;IAC5F,4FAA4F;IAC5F,wFAAwF;IACxF,gCAAgC;IAChC,GAAG,cAAc;IACjB,wFAAwF;IACxF,oDAAoD;IACpD,GAAG,UAAU;IACb,wFAAwF;IACxF,+EAA+E;IAC/E,+EAA+E;IAC/E,sFAAsF;IACtF,wFAAwF;IACxF,mDAAmD;IACnD,uIAAuI;IACvI,8FAA8F;IAC9F,yFAAyF;IACzF,wFAAwF;IACxF,yFAAyF;IACzF,mFAAmF;IACnF,GAAG,iBAAiB;CACrB,CAAC;AAMF,MAAM,OAAO,UAAW,SAAQ,aAA4B;IAC1D,6GAA6G;IACrG,UAAU,CAAU;IAE5B,YAAY,GAAuB,EAAE,GAAkB;QACrD,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,KAAK,MAAM,IAAI,IAAI,iBAAiB;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,oFAAoF;YACpF,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC,CAAC;YAC5D,sFAAsF;YACtF,qFAAqF;YACrF,mFAAmF;YACnF,2EAA2E;YAC3E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC,CAAkC,CAAC;YAChI,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,OAA8C;QAClF,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,6EAA6E,EAC7E,OAAO,EAAE,GAAG,EAAE,KAAK,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,GAAG,CAAC,GAAa,CAAC,GAAG,GAAG,CAAC,KAAe,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,GAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC,CAAC,CAAmC,EAAE,KAAK,CAAC;QAClJ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE,MAAM,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;QAC1D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,oFAAoF;IACpF,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACjF,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU;QACnE,OAAO,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACxF,OAAO,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,GAAW;QACjD,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAuB;QAChF,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,SAAiB;QACxD,OAAO,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAAe,EAAE,GAAW,EAAE,YAAoB,EAAE,SAAiB;QAChG,OAAO,yBAAyB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC9D,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAoB,EAAE,SAAiB;QAC7G,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACnF,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,SAAiB;QAChD,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,OAAO,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC/D,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAW;QACvC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED;+FAC2F;IAC3F,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,KAAa;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,OAAe;QACtC,OAAO,qBAAqB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,kFAAkF;IAC1E,IAAI,CAAC,MAAc,EAAE,YAA4B,EAAE,sBAAsB,GAAG,KAAK;QACvF,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5D,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE;YAC3E,qFAAqF;YACrF,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;YAC/F,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,iFAAiF;YACjF,oFAAoF;YACpF,sFAAsF;YACtF,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;gBAClF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,KAAK,CAAC,OAAgB;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAClE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,SAAS,EAC5D,GAAG,CAAC,QAAQ,EACZ,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAClF,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,8EAA8E;YAC9E,8EAA8E;YAC9E,uDAAuD;YACvD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAC1C,+DAA+D,CAChE,CAAC,CAAC,CAAC,CAAkC,CAAC;YACvC,IAAI,MAAM,EAAE,KAAK,KAAK,aAAa,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,iFAAiF,EAAE,aAAa,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,CAAC,QAAkB,EAAY,EAAE,CACnD,6BAA6B,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,OAAO,GAAuB,OAAO,EAAE,IAAI;gBAC/C,CAAC,CAAC;oBACE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;oBACpB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;oBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI;oBAC/B,oEAAoE;oBACpE,6EAA6E;oBAC7E,sCAAsC;oBACtC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;iBAC1C;gBACH,CAAC,CAAC,IAAI,CAAC;YACT,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;CACF;AA0CD,MAAM,CAAC,MAAM,gBAAgB,GAA2F,IAAI,CAAC;AAE7H;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAiC,EACjC,MAAc,EACd,IAAyE;IAEzE,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAW,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1F,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACvF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/invite-routes.d.ts
CHANGED
|
@@ -14,24 +14,26 @@
|
|
|
14
14
|
* act the moment somebody binds to it), and records the invite in the tenant's identity
|
|
15
15
|
* directory keyed by the token's SHA-256; the plaintext token rides only in the returned
|
|
16
16
|
* accept link. Accepting binds the invitee's verified subject to that pre-minted principal,
|
|
17
|
-
* and the directory then resolves them as that member. Revoking
|
|
18
|
-
*
|
|
17
|
+
* and the directory then resolves them as that member. Revoking takes the principal's scope
|
|
18
|
+
* roles back and then removes the invite row.
|
|
19
19
|
*
|
|
20
20
|
* Who may invite, and at which role, are two questions (#1931). The vertical's admin gate
|
|
21
21
|
* answers the first — may this caller manage members at all. The second is the kernel's
|
|
22
22
|
* assignment bound (`ctx.canAssign`): a caller may confer a role only if they already hold
|
|
23
|
-
* every permission it carries at this scope, and
|
|
23
|
+
* every permission it carries at this scope, and withdrawing an invite takes the same bound,
|
|
24
|
+
* over the roles its principal holds now — the scope's tuples, never the row's `roleKey`. The
|
|
24
25
|
* gate runs before the body is read, so it cannot know the role; the bound is applied here,
|
|
25
26
|
* after the role is parsed, by the platform rather than by each vertical remembering it —
|
|
26
27
|
* otherwise a vertical offering two roles lets anyone its gate admits confer the higher one.
|
|
27
28
|
*
|
|
28
|
-
*
|
|
29
|
-
*
|
|
30
|
-
*
|
|
31
|
-
*
|
|
29
|
+
* The dashboard manages the same members through vertical-host's `/internal/members*` (#1150),
|
|
30
|
+
* minting with the same `mintMemberInvite` below. Deliberately NOT here: the richer invite a
|
|
31
|
+
* support desk runs (contact-bound roles, staff profiles), which is a different flow rather
|
|
32
|
+
* than this one with more fields.
|
|
32
33
|
*/
|
|
33
34
|
import type { Context, Hono } from 'hono';
|
|
34
|
-
import {
|
|
35
|
+
import { HTTPException } from 'hono/http-exception';
|
|
36
|
+
import { z, type Coverage, type MemberInviteLink, type PrincipalId, type ScopeId, type TenantId } from '@substrat-run/contracts';
|
|
35
37
|
import type { IdentityStub } from './identity-do.js';
|
|
36
38
|
import type { AuthProvider } from './provider.js';
|
|
37
39
|
/** The slice of the identity directory the invite routes touch. */
|
|
@@ -63,17 +65,21 @@ export interface InviteRouteDeps<E extends object, N extends {
|
|
|
63
65
|
/**
|
|
64
66
|
* Gate the three admin routes: throw 401 for nobody, 403 for a caller who may not manage
|
|
65
67
|
* members. The vertical decides what "admin" means — a role, a permission, a whoami — and
|
|
66
|
-
* returns the principal it admitted, which is who
|
|
68
|
+
* returns the principal it admitted, which is who every bound is then asked about.
|
|
67
69
|
*/
|
|
68
70
|
requireAdmin: (c: Context<{
|
|
69
71
|
Bindings: E;
|
|
70
72
|
}>) => Promise<InviteCaller>;
|
|
71
73
|
/**
|
|
72
|
-
*
|
|
73
|
-
*
|
|
74
|
-
*
|
|
74
|
+
* Take every scope role `principal` holds, bounded by `caller` over each, in ONE scope task —
|
|
75
|
+
* the host's `revokeScopeRolesBounded`. What a withdrawal is bounded by (#1150): the roles the
|
|
76
|
+
* invite's principal ACTUALLY holds, read where they are written, never the role the invite row
|
|
77
|
+
* recorded when it was minted. Required: a mount without it refuses create and revoke.
|
|
75
78
|
*/
|
|
76
|
-
|
|
79
|
+
revokeScopeRolesBounded: (env: E, node: N, caller: PrincipalId, principal: PrincipalId) => Promise<{
|
|
80
|
+
coverage: Coverage;
|
|
81
|
+
revoked: string[];
|
|
82
|
+
}>;
|
|
77
83
|
/** Check the bound and grant in one scope task. A refusal returns coverage and writes nothing. */
|
|
78
84
|
assignScopeRoleBounded: (env: E, node: N, caller: PrincipalId, assignee: PrincipalId, roleKey: string) => Promise<Coverage>;
|
|
79
85
|
/** The role keys a teammate may be invited at — the vertical's own ROLES. */
|
|
@@ -96,6 +102,37 @@ export interface InviteRouteDeps<E extends object, N extends {
|
|
|
96
102
|
*/
|
|
97
103
|
origin?: (req: Request) => string;
|
|
98
104
|
}
|
|
105
|
+
/** The 403 a refused bound answers, in one wording for every door that confers a role. */
|
|
106
|
+
export declare const uncovered: (missing: readonly string[], roleKey: string, act: string) => HTTPException;
|
|
107
|
+
/**
|
|
108
|
+
* Mint one member invite (#1150) — the ONE copy of what an invite is, shared by the vertical's
|
|
109
|
+
* own `POST /api/invites` and the platform's `/internal/members/invite` (vertical-host), so the
|
|
110
|
+
* two doors cannot drift on the token, the hash, or the order.
|
|
111
|
+
*
|
|
112
|
+
* Pre-mint a principal; grant it the role through `grant`, which MUST be the bounded grant
|
|
113
|
+
* (check and write in one scope task) — a refusal returns its coverage and nothing else is
|
|
114
|
+
* written; then record the invite under the token's SHA-256. The grant comes first: a row whose
|
|
115
|
+
* principal holds nothing is a link to no access, while a grant with no row is inert — nobody
|
|
116
|
+
* can bind to it. The two writes are two Durable Objects with no transaction between them, so a
|
|
117
|
+
* failed record takes the grant back (`rollback`) before the failure is rethrown: inert is not
|
|
118
|
+
* harmless when every retry would mint another orphan. If the rollback fails too, the ORIGINAL
|
|
119
|
+
* failure is what the caller hears.
|
|
120
|
+
*/
|
|
121
|
+
export declare function mintMemberInvite(steps: {
|
|
122
|
+
grant: (assignee: PrincipalId) => Promise<Coverage>;
|
|
123
|
+
record: (principal: PrincipalId, tokenHash: string) => Promise<void>;
|
|
124
|
+
rollback: (principal: PrincipalId) => Promise<unknown>;
|
|
125
|
+
}, input: {
|
|
126
|
+
roleKey: string;
|
|
127
|
+
email: string | null;
|
|
128
|
+
origin: string;
|
|
129
|
+
}): Promise<{
|
|
130
|
+
ok: true;
|
|
131
|
+
invite: MemberInviteLink;
|
|
132
|
+
} | {
|
|
133
|
+
ok: false;
|
|
134
|
+
coverage: Coverage;
|
|
135
|
+
}>;
|
|
99
136
|
/**
|
|
100
137
|
* Mount the four invite routes on a vertical's Hono app:
|
|
101
138
|
*
|
|
@@ -116,5 +153,26 @@ export declare function mountInviteRoutes<E extends object, N extends {
|
|
|
116
153
|
}>(app: Hono<{
|
|
117
154
|
Bindings: E;
|
|
118
155
|
}>, deps: InviteRouteDeps<E, N>): void;
|
|
156
|
+
/**
|
|
157
|
+
* What a vertical hands `mountPlatformSurface` to let the platform manage its members from the
|
|
158
|
+
* dashboard (#1150) — vertical-host's `members` hook. `roles` is the same list the vertical gives
|
|
159
|
+
* `mountInviteRoutes`; `directory` is its tenant's IdentityDO; the minting is `mintMemberInvite`,
|
|
160
|
+
* so an invite the dashboard asks for is the same thing the vertical's own screen makes, and is
|
|
161
|
+
* accepted at the vertical's own `/api/accept-invite`.
|
|
162
|
+
*/
|
|
163
|
+
export declare function membersHook<E, D extends InviteDirectory & Pick<IdentityStub, 'listMemberBindings' | 'unbindPrincipal'>>(opts: {
|
|
164
|
+
roles: readonly string[];
|
|
165
|
+
directory: (env: E, ref: {
|
|
166
|
+
tenantId: TenantId;
|
|
167
|
+
scopeId: ScopeId;
|
|
168
|
+
}) => D;
|
|
169
|
+
}): {
|
|
170
|
+
roles: readonly string[];
|
|
171
|
+
directory: (env: E, ref: {
|
|
172
|
+
tenantId: TenantId;
|
|
173
|
+
scopeId: ScopeId;
|
|
174
|
+
}) => D;
|
|
175
|
+
mint: typeof mintMemberInvite;
|
|
176
|
+
};
|
|
119
177
|
export {};
|
|
120
178
|
//# sourceMappingURL=invite-routes.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"invite-routes.d.ts","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"invite-routes.d.ts","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAA0C,CAAC,EAAE,KAAK,QAAQ,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEzK,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,cAAc,GAAG,aAAa,CAAC,CAAC;AAEhI,QAAA,MAAM,YAAY;;iBAAuC,CAAC;AAE1D,uFAAuF;AACvF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,0CAA0C;AAC1C,eAAO,MAAM,UAAU;;;iBAIrB,CAAC;AAEH,gDAAgD;AAChD,eAAO,MAAM,gBAAgB;;iBAAyC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;IAC9E,0FAA0F;IAC1F,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IACrE;;;;;OAKG;IACH,uBAAuB,EAAE,CACvB,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,KACzD,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACxD,kGAAkG;IAClG,sBAAsB,EAAE,CACtB,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KACzE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvB,6EAA6E;IAC7E,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,yFAAyF;IACzF,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,eAAe,CAAC;IAChD;;;;;OAKG;IACH,eAAe,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,oGAAoG;IACpG,YAAY,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CACnC;AAED,0FAA0F;AAC1F,eAAO,MAAM,SAAS,YAAa,SAAS,MAAM,EAAE,WAAW,MAAM,OAAO,MAAM,KAAG,aACR,CAAC;AAG9E;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE;IACL,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD,EACD,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAiBrF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EAC/E,GAAG,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,CAAC,CAAA;CAAE,CAAC,EAC1B,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAC1B,IAAI,CA0FN;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,CAAC,SAAS,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,oBAAoB,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE;IAC7H,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,CAAC,CAAC;CACzE;IACU,KAAK;IAAc,SAAS,QAFpB,CAAC,OAAO;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,CAAC;IAEhB,IAAI;EAC5D"}
|
package/dist/invite-routes.js
CHANGED
|
@@ -14,25 +14,26 @@
|
|
|
14
14
|
* act the moment somebody binds to it), and records the invite in the tenant's identity
|
|
15
15
|
* directory keyed by the token's SHA-256; the plaintext token rides only in the returned
|
|
16
16
|
* accept link. Accepting binds the invitee's verified subject to that pre-minted principal,
|
|
17
|
-
* and the directory then resolves them as that member. Revoking
|
|
18
|
-
*
|
|
17
|
+
* and the directory then resolves them as that member. Revoking takes the principal's scope
|
|
18
|
+
* roles back and then removes the invite row.
|
|
19
19
|
*
|
|
20
20
|
* Who may invite, and at which role, are two questions (#1931). The vertical's admin gate
|
|
21
21
|
* answers the first — may this caller manage members at all. The second is the kernel's
|
|
22
22
|
* assignment bound (`ctx.canAssign`): a caller may confer a role only if they already hold
|
|
23
|
-
* every permission it carries at this scope, and
|
|
23
|
+
* every permission it carries at this scope, and withdrawing an invite takes the same bound,
|
|
24
|
+
* over the roles its principal holds now — the scope's tuples, never the row's `roleKey`. The
|
|
24
25
|
* gate runs before the body is read, so it cannot know the role; the bound is applied here,
|
|
25
26
|
* after the role is parsed, by the platform rather than by each vertical remembering it —
|
|
26
27
|
* otherwise a vertical offering two roles lets anyone its gate admits confer the higher one.
|
|
27
28
|
*
|
|
28
|
-
*
|
|
29
|
-
*
|
|
30
|
-
*
|
|
31
|
-
*
|
|
29
|
+
* The dashboard manages the same members through vertical-host's `/internal/members*` (#1150),
|
|
30
|
+
* minting with the same `mintMemberInvite` below. Deliberately NOT here: the richer invite a
|
|
31
|
+
* support desk runs (contact-bound roles, staff profiles), which is a different flow rather
|
|
32
|
+
* than this one with more fields.
|
|
32
33
|
*/
|
|
33
34
|
import { HTTPException } from 'hono/http-exception';
|
|
34
|
-
import { coverage, principalId, z } from '@substrat-run/contracts';
|
|
35
|
-
import {
|
|
35
|
+
import { coverage, coverageRefusal, principalId, z } from '@substrat-run/contracts';
|
|
36
|
+
import { ulid } from '@substrat-run/kernel';
|
|
36
37
|
import { claimToken, invitePath, sha256Hex } from './owner-claim-link.js';
|
|
37
38
|
import { bodyOf } from './request-body.js';
|
|
38
39
|
const inviteCaller = z.object({ principal: principalId });
|
|
@@ -44,6 +45,42 @@ export const inviteBody = z.object({
|
|
|
44
45
|
});
|
|
45
46
|
/** The body `POST /api/accept-invite` takes. */
|
|
46
47
|
export const acceptInviteBody = z.object({ token: z.string().min(1) });
|
|
48
|
+
/** The 403 a refused bound answers, in one wording for every door that confers a role. */
|
|
49
|
+
export const uncovered = (missing, roleKey, act) => new HTTPException(403, { message: coverageRefusal(missing, roleKey, act) });
|
|
50
|
+
/**
|
|
51
|
+
* Mint one member invite (#1150) — the ONE copy of what an invite is, shared by the vertical's
|
|
52
|
+
* own `POST /api/invites` and the platform's `/internal/members/invite` (vertical-host), so the
|
|
53
|
+
* two doors cannot drift on the token, the hash, or the order.
|
|
54
|
+
*
|
|
55
|
+
* Pre-mint a principal; grant it the role through `grant`, which MUST be the bounded grant
|
|
56
|
+
* (check and write in one scope task) — a refusal returns its coverage and nothing else is
|
|
57
|
+
* written; then record the invite under the token's SHA-256. The grant comes first: a row whose
|
|
58
|
+
* principal holds nothing is a link to no access, while a grant with no row is inert — nobody
|
|
59
|
+
* can bind to it. The two writes are two Durable Objects with no transaction between them, so a
|
|
60
|
+
* failed record takes the grant back (`rollback`) before the failure is rethrown: inert is not
|
|
61
|
+
* harmless when every retry would mint another orphan. If the rollback fails too, the ORIGINAL
|
|
62
|
+
* failure is what the caller hears.
|
|
63
|
+
*/
|
|
64
|
+
export async function mintMemberInvite(steps, input) {
|
|
65
|
+
const principal = principalId.parse(ulid());
|
|
66
|
+
// A long, URL-safe token; only its hash is stored. Two UUIDs = 256 bits of entropy.
|
|
67
|
+
const token = claimToken();
|
|
68
|
+
const bound = coverage.safeParse(await steps.grant(principal));
|
|
69
|
+
if (!bound.success) {
|
|
70
|
+
throw new HTTPException(500, { message: 'the canAssign bound did not answer with a coverage — refusing' });
|
|
71
|
+
}
|
|
72
|
+
if (!bound.data.covered)
|
|
73
|
+
return { ok: false, coverage: bound.data };
|
|
74
|
+
try {
|
|
75
|
+
await steps.record(principal, await sha256Hex(token));
|
|
76
|
+
}
|
|
77
|
+
catch (err) {
|
|
78
|
+
await steps.rollback(principal).catch(() => undefined);
|
|
79
|
+
throw err;
|
|
80
|
+
}
|
|
81
|
+
const origin = input.origin.replace(/\/$/, '');
|
|
82
|
+
return { ok: true, invite: { principal, roleKey: input.roleKey, email: input.email, acceptUrl: `${origin}${invitePath(token)}` } };
|
|
83
|
+
}
|
|
47
84
|
/**
|
|
48
85
|
* Mount the four invite routes on a vertical's Hono app:
|
|
49
86
|
*
|
|
@@ -63,8 +100,8 @@ export function mountInviteRoutes(app, deps) {
|
|
|
63
100
|
const originOf = (req) => (deps.origin?.(req) ?? new URL(req.url).origin).replace(/\/$/, '');
|
|
64
101
|
/** Who the gate admitted — refusing a mount wired short or a gate naming no caller. */
|
|
65
102
|
const admitted = (caller) => {
|
|
66
|
-
if (typeof deps.
|
|
67
|
-
throw new HTTPException(500, { message: 'invites are mounted without the
|
|
103
|
+
if (typeof deps.revokeScopeRolesBounded !== 'function') {
|
|
104
|
+
throw new HTTPException(500, { message: 'invites are mounted without the bounded revoke — refusing to withdraw an unbounded role' });
|
|
68
105
|
}
|
|
69
106
|
if (typeof deps.assignScopeRoleBounded !== 'function') {
|
|
70
107
|
throw new HTTPException(500, { message: 'invites are mounted without the bounded grant — refusing to confer an unbounded role' });
|
|
@@ -81,11 +118,9 @@ export function mountInviteRoutes(app, deps) {
|
|
|
81
118
|
if (!bound.success) {
|
|
82
119
|
throw new HTTPException(500, { message: 'the canAssign bound did not answer with a coverage — refusing' });
|
|
83
120
|
}
|
|
84
|
-
if (!bound.data.covered)
|
|
85
|
-
throw
|
|
86
|
-
}
|
|
121
|
+
if (!bound.data.covered)
|
|
122
|
+
throw uncovered(bound.data.missing, roleKey, act);
|
|
87
123
|
};
|
|
88
|
-
const assertCanAssign = async (env, node, caller, roleKey, act) => assertCoverage(await deps.canAssign(env, node, caller.principal, roleKey), roleKey, act);
|
|
89
124
|
app.get('/api/invites', async (c) => {
|
|
90
125
|
const node = await deps.nodeFor(c.req.raw, c.env);
|
|
91
126
|
await deps.requireAdmin(c);
|
|
@@ -98,50 +133,43 @@ export function mountInviteRoutes(app, deps) {
|
|
|
98
133
|
const { email, roleKey } = await bodyOf(c, inviteBody);
|
|
99
134
|
if (!deps.roles.includes(roleKey))
|
|
100
135
|
throw new HTTPException(400, { message: `unknown role '${roleKey}'` });
|
|
101
|
-
const
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
}
|
|
110
|
-
catch (err) {
|
|
111
|
-
// Two Durable Objects, no transaction between them. Inert is not the same as
|
|
112
|
-
// harmless: every retry of a failing create would mint another principal with a
|
|
113
|
-
// role and no row, so the grant is taken back before the failure is reported. If
|
|
114
|
-
// the revoke fails too, the ORIGINAL failure is what the caller hears — it is the
|
|
115
|
-
// one that explains the request — and the orphan is the state this comment names.
|
|
116
|
-
await deps.revokeScopeRole(c.env, node.scopeId, principal, roleKey).catch(() => undefined);
|
|
117
|
-
throw err;
|
|
118
|
-
}
|
|
119
|
-
return c.json({ principal, roleKey, email: email ?? null, acceptUrl: `${originOf(c.req.raw)}${invitePath(token)}` }, 201);
|
|
136
|
+
const minted = await mintMemberInvite({
|
|
137
|
+
grant: (assignee) => deps.assignScopeRoleBounded(c.env, node, caller.principal, assignee, roleKey),
|
|
138
|
+
record: (principal, tokenHash) => deps.directory(c.env, node).createInvite(node.scopeId, principal, roleKey, email ?? null, tokenHash),
|
|
139
|
+
rollback: (principal) => deps.revokeScopeRole(c.env, node.scopeId, principal, roleKey),
|
|
140
|
+
}, { roleKey, email: email ?? null, origin: originOf(c.req.raw) });
|
|
141
|
+
if (!minted.ok)
|
|
142
|
+
throw uncovered(minted.coverage.missing, roleKey, 'invite at');
|
|
143
|
+
return c.json(minted.invite, 201);
|
|
120
144
|
});
|
|
121
145
|
app.post('/api/invites/:principal/revoke', async (c) => {
|
|
122
146
|
const node = await deps.nodeFor(c.req.raw, c.env);
|
|
123
147
|
const caller = admitted(await deps.requireAdmin(c));
|
|
124
148
|
const directory = deps.directory(c.env, node);
|
|
125
|
-
const principal = c.req.param('principal');
|
|
126
|
-
//
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
}
|
|
141
|
-
await directory.revokeInvite(node.scopeId, principal);
|
|
149
|
+
const principal = principalId.safeParse(c.req.param('principal'));
|
|
150
|
+
// No open invite: nothing to withdraw, answered as before.
|
|
151
|
+
const invite = principal.success ? await directory.getInvite(node.scopeId, principal.data) : null;
|
|
152
|
+
if (principal.success && invite) {
|
|
153
|
+
// Withdrawal takes the bound of every role the invite's principal HOLDS, asked and written in
|
|
154
|
+
// one scope task (#1150, Codex #2057 r2). Not the row's `roleKey`: that is what was minted,
|
|
155
|
+
// and the scope can have moved since — a role move landing between an invite's grant and its
|
|
156
|
+
// row would otherwise leave a lead's invite withdrawable by an agent. The grant goes with
|
|
157
|
+
// it, first: a refusal writes nothing, and the row can only go once the roles have. A role
|
|
158
|
+
// the tenant no longer defines confers nothing and is taken without a bound, so a link at
|
|
159
|
+
// one can still be withdrawn. An accept landing between the two binds a login to a
|
|
160
|
+
// principal holding nothing.
|
|
161
|
+
const taken = await deps.revokeScopeRolesBounded(c.env, node, caller.principal, principal.data);
|
|
162
|
+
assertCoverage(taken.coverage, principal.data, 'withdraw the invite of');
|
|
163
|
+
await directory.revokeInvite(node.scopeId, principal.data);
|
|
142
164
|
}
|
|
143
165
|
return c.body(null, 204);
|
|
144
166
|
});
|
|
167
|
+
// INVARIANT (#1150): an accept never writes to the scope. The role was granted when the invite
|
|
168
|
+
// was minted; accepting only binds the subject in the identity directory, the same Durable
|
|
169
|
+
// Object the platform's member removal withdraws the invite and unbinds in — so a removal and
|
|
170
|
+
// an accept are serialized there, and an accept after a removal finds no invite. If a future
|
|
171
|
+
// accept path grants in the scope (ticket0's portal grant is one), a removal marker the grant
|
|
172
|
+
// checks becomes required, or a held accept could re-grant a removed person.
|
|
145
173
|
app.post('/api/accept-invite', async (c) => {
|
|
146
174
|
const node = await deps.nodeFor(c.req.raw, c.env);
|
|
147
175
|
const subject = await (await deps.authProvider(c.env, c.req.raw)).resolve(c.req.raw.headers);
|
|
@@ -154,4 +182,14 @@ export function mountInviteRoutes(app, deps) {
|
|
|
154
182
|
return c.json({ ok: true, principal });
|
|
155
183
|
});
|
|
156
184
|
}
|
|
185
|
+
/**
|
|
186
|
+
* What a vertical hands `mountPlatformSurface` to let the platform manage its members from the
|
|
187
|
+
* dashboard (#1150) — vertical-host's `members` hook. `roles` is the same list the vertical gives
|
|
188
|
+
* `mountInviteRoutes`; `directory` is its tenant's IdentityDO; the minting is `mintMemberInvite`,
|
|
189
|
+
* so an invite the dashboard asks for is the same thing the vertical's own screen makes, and is
|
|
190
|
+
* accepted at the vertical's own `/api/accept-invite`.
|
|
191
|
+
*/
|
|
192
|
+
export function membersHook(opts) {
|
|
193
|
+
return { roles: opts.roles, directory: opts.directory, mint: mintMemberInvite };
|
|
194
|
+
}
|
|
157
195
|
//# sourceMappingURL=invite-routes.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"invite-routes.js","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"invite-routes.js","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,EAAuF,MAAM,yBAAyB,CAAC;AACzK,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAM3C,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;AAK1D,0CAA0C;AAC1C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACpC,qEAAqE;IACrE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAkDvE,0FAA0F;AAC1F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAA0B,EAAE,OAAe,EAAE,GAAW,EAAiB,EAAE,CACnG,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAG9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAIC,EACD,KAAgE;IAEhE,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,oFAAoF;IACpF,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;AACrI,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAA0B,EAC1B,IAA2B;IAE3B,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE9G,uFAAuF;IACvF,MAAM,QAAQ,GAAG,CAAC,MAAe,EAAgB,EAAE;QACjD,IAAI,OAAO,IAAI,CAAC,uBAAuB,KAAK,UAAU,EAAE,CAAC;YACvD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yFAAyF,EAAE,CAAC,CAAC;QACvI,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sFAAsF,EAAE,CAAC,CAAC;QACpI,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,4FAA4F,EAAE,CAAC,CAAC;QAC1I,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC,CAAC;IAEF,iFAAiF;IACjF,MAAM,cAAc,GAAG,CAAC,MAAe,EAAE,OAAe,EAAE,GAAW,EAAQ,EAAE;QAC7E,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,+FAA+F;QAC/F,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iBAAiB,OAAO,GAAG,EAAE,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC;YACE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC;YAClG,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAC/B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,SAAS,CAAC;YACtG,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;SACvF,EACD,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/D,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAClE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClG,IAAI,SAAS,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;YAChC,8FAA8F;YAC9F,4FAA4F;YAC5F,6FAA6F;YAC7F,0FAA0F;YAC1F,2FAA2F;YAC3F,0FAA0F;YAC1F,mFAAmF;YACnF,6BAA6B;YAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YAChG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;YACzE,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,+FAA+F;IAC/F,2FAA2F;IAC3F,8FAA8F;IAC9F,6FAA6F;IAC7F,8FAA8F;IAC9F,6EAA6E;IAC7E,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACnH,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAA8F,IAGxH;IACC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;AAClF,CAAC"}
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The MEMBER-INVITE half of the identity directory — the `invite` table and the rows over it —
|
|
3
|
+
* written as plain functions over the `exec` seam so they are tested against real SQLite
|
|
4
|
+
* without a Durable Object, the way `owner-seat.ts` and `site-registry.ts` are. The IdentityDO
|
|
5
|
+
* delegates every invite method here.
|
|
6
|
+
*
|
|
7
|
+
* An invite is a pre-minted principal + a role the inviter already granted at scope level,
|
|
8
|
+
* waiting for a login to claim it by token. Only the token's HASH is stored — the token itself
|
|
9
|
+
* lives in the accept link, never here, so a read of this table cannot mint access.
|
|
10
|
+
*/
|
|
11
|
+
import type { RegistrySql } from './site-registry.js';
|
|
12
|
+
export { migrateOwnerSeat, unbindPrincipal } from './owner-seat.js';
|
|
13
|
+
export type { RegistrySql } from './site-registry.js';
|
|
14
|
+
export declare const INVITE_DDL: string[];
|
|
15
|
+
/** The whole directory an invite touches: the identity (and owner-seat) tables, then the invites. */
|
|
16
|
+
export declare const MEMBER_DIRECTORY_DDL: readonly string[];
|
|
17
|
+
/** An outstanding invite as the directory returns it — never its token. */
|
|
18
|
+
export type InviteRow = {
|
|
19
|
+
principal: string;
|
|
20
|
+
roleKey: string;
|
|
21
|
+
email: string | null;
|
|
22
|
+
createdAt: number;
|
|
23
|
+
};
|
|
24
|
+
/** One principal as the identity directory knows it at a scope (#1150). */
|
|
25
|
+
export type MemberBinding = {
|
|
26
|
+
principal: string;
|
|
27
|
+
logins: number;
|
|
28
|
+
email: string | null;
|
|
29
|
+
};
|
|
30
|
+
export declare function createInvite(sql: RegistrySql, scopeId: string, principal: string, roleKey: string, email: string | null, tokenHash: string): void;
|
|
31
|
+
/** The scope's outstanding (unclaimed) invites, newest first. No token. */
|
|
32
|
+
export declare function listInvites(sql: RegistrySql, scopeId: string): InviteRow[];
|
|
33
|
+
/** One outstanding invite by its pre-minted principal, or null (#1931). */
|
|
34
|
+
export declare function getInvite(sql: RegistrySql, scopeId: string, principal: string): InviteRow | null;
|
|
35
|
+
export declare function inviteExists(sql: RegistrySql, scopeId: string, tokenHash: string): boolean;
|
|
36
|
+
/** Withdraw an unclaimed invite by its pre-minted principal. */
|
|
37
|
+
export declare function revokeInvite(sql: RegistrySql, scopeId: string, principal: string): void;
|
|
38
|
+
/**
|
|
39
|
+
* Claim an invite: bind the verified subject to the invite's pre-minted principal and consume
|
|
40
|
+
* the invite, with no await between the read and the writes — so in the Durable Object a
|
|
41
|
+
* withdrawal (`revokeInvite`) and a claim are serialized, and a claim after a withdrawal finds
|
|
42
|
+
* nothing. Returns the principal, or null when no unclaimed invite matches. It writes nothing
|
|
43
|
+
* to the scope: the role was granted when the invite was minted.
|
|
44
|
+
*/
|
|
45
|
+
export declare function claimInvite(sql: RegistrySql, scopeId: string, sub: string, tokenHash: string): string | null;
|
|
46
|
+
/**
|
|
47
|
+
* Who this directory knows at the scope, by principal (#1150): how many subjects are bound to
|
|
48
|
+
* each, and the address an invite to it named — the identity half of the dashboard's member
|
|
49
|
+
* roster. The role half is the scope's own (`listScopeRoleHolders`). One scope, never a walk.
|
|
50
|
+
*/
|
|
51
|
+
export declare function listMemberBindings(sql: RegistrySql, scopeId: string): MemberBinding[];
|
|
52
|
+
//# sourceMappingURL=member-directory.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"member-directory.d.ts","sourceRoot":"","sources":["../src/member-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,eAAO,MAAM,UAAU,EAAE,MAAM,EAM9B,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAuC,CAAC;AAE1F,2EAA2E;AAC3E,MAAM,MAAM,SAAS,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAExG,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AASxF,wBAAgB,YAAY,CAC1B,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAC7G,IAAI,CAKN;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,CAK1E;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAMhG;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE1F;AAED,gEAAgE;AAChE,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAEvF;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5G;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAarF"}
|
|
@@ -0,0 +1,69 @@
|
|
|
1
|
+
import { OWNER_SEAT_DDL } from './owner-seat.js';
|
|
2
|
+
// The identity rows an invite binds into, for a host that keeps this directory outside a DO.
|
|
3
|
+
export { migrateOwnerSeat, unbindPrincipal } from './owner-seat.js';
|
|
4
|
+
export const INVITE_DDL = [
|
|
5
|
+
`CREATE TABLE IF NOT EXISTS invite (
|
|
6
|
+
token_hash TEXT PRIMARY KEY, scope_id TEXT NOT NULL, principal TEXT NOT NULL,
|
|
7
|
+
role_key TEXT NOT NULL, email TEXT, claimed INTEGER NOT NULL DEFAULT 0,
|
|
8
|
+
created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)))`,
|
|
9
|
+
`CREATE INDEX IF NOT EXISTS invite_by_scope ON invite (scope_id)`,
|
|
10
|
+
];
|
|
11
|
+
/** The whole directory an invite touches: the identity (and owner-seat) tables, then the invites. */
|
|
12
|
+
export const MEMBER_DIRECTORY_DDL = [...OWNER_SEAT_DDL, ...INVITE_DDL];
|
|
13
|
+
const inviteRowOf = (r) => ({
|
|
14
|
+
principal: r.principal,
|
|
15
|
+
roleKey: r.role_key,
|
|
16
|
+
email: r.email ?? null,
|
|
17
|
+
createdAt: Number(r.created_at),
|
|
18
|
+
});
|
|
19
|
+
export function createInvite(sql, scopeId, principal, roleKey, email, tokenHash) {
|
|
20
|
+
sql.exec('INSERT INTO invite (token_hash, scope_id, principal, role_key, email) VALUES (?, ?, ?, ?, ?)', tokenHash, scopeId, principal, roleKey, email);
|
|
21
|
+
}
|
|
22
|
+
/** The scope's outstanding (unclaimed) invites, newest first. No token. */
|
|
23
|
+
export function listInvites(sql, scopeId) {
|
|
24
|
+
return [...sql.exec('SELECT principal, role_key, email, created_at FROM invite WHERE scope_id = ? AND claimed = 0 ORDER BY created_at DESC', scopeId)].map(inviteRowOf);
|
|
25
|
+
}
|
|
26
|
+
/** One outstanding invite by its pre-minted principal, or null (#1931). */
|
|
27
|
+
export function getInvite(sql, scopeId, principal) {
|
|
28
|
+
const r = [...sql.exec('SELECT principal, role_key, email, created_at FROM invite WHERE scope_id = ? AND principal = ? AND claimed = 0', scopeId, principal)][0];
|
|
29
|
+
return r ? inviteRowOf(r) : null;
|
|
30
|
+
}
|
|
31
|
+
export function inviteExists(sql, scopeId, tokenHash) {
|
|
32
|
+
return [...sql.exec('SELECT 1 FROM invite WHERE scope_id = ? AND token_hash = ? AND claimed = 0', scopeId, tokenHash)].length > 0;
|
|
33
|
+
}
|
|
34
|
+
/** Withdraw an unclaimed invite by its pre-minted principal. */
|
|
35
|
+
export function revokeInvite(sql, scopeId, principal) {
|
|
36
|
+
sql.exec('DELETE FROM invite WHERE scope_id = ? AND principal = ? AND claimed = 0', scopeId, principal);
|
|
37
|
+
}
|
|
38
|
+
/**
|
|
39
|
+
* Claim an invite: bind the verified subject to the invite's pre-minted principal and consume
|
|
40
|
+
* the invite, with no await between the read and the writes — so in the Durable Object a
|
|
41
|
+
* withdrawal (`revokeInvite`) and a claim are serialized, and a claim after a withdrawal finds
|
|
42
|
+
* nothing. Returns the principal, or null when no unclaimed invite matches. It writes nothing
|
|
43
|
+
* to the scope: the role was granted when the invite was minted.
|
|
44
|
+
*/
|
|
45
|
+
export function claimInvite(sql, scopeId, sub, tokenHash) {
|
|
46
|
+
const inv = [...sql.exec('SELECT principal FROM invite WHERE scope_id = ? AND token_hash = ? AND claimed = 0', scopeId, tokenHash)][0];
|
|
47
|
+
if (!inv)
|
|
48
|
+
return null;
|
|
49
|
+
sql.exec('INSERT OR REPLACE INTO identity (scope_id, sub, principal) VALUES (?, ?, ?)', scopeId, sub, inv.principal);
|
|
50
|
+
sql.exec('UPDATE invite SET claimed = 1 WHERE scope_id = ? AND token_hash = ?', scopeId, tokenHash);
|
|
51
|
+
return inv.principal;
|
|
52
|
+
}
|
|
53
|
+
/**
|
|
54
|
+
* Who this directory knows at the scope, by principal (#1150): how many subjects are bound to
|
|
55
|
+
* each, and the address an invite to it named — the identity half of the dashboard's member
|
|
56
|
+
* roster. The role half is the scope's own (`listScopeRoleHolders`). One scope, never a walk.
|
|
57
|
+
*/
|
|
58
|
+
export function listMemberBindings(sql, scopeId) {
|
|
59
|
+
return [...sql.exec(`SELECT principal, SUM(login) AS logins, MAX(email) AS email FROM (
|
|
60
|
+
SELECT principal, 1 AS login, NULL AS email FROM identity WHERE scope_id = ?
|
|
61
|
+
UNION ALL
|
|
62
|
+
SELECT principal, 0 AS login, email FROM invite WHERE scope_id = ?
|
|
63
|
+
) GROUP BY principal ORDER BY principal`, scopeId, scopeId)].map((r) => ({
|
|
64
|
+
principal: r.principal,
|
|
65
|
+
logins: Number(r.logins),
|
|
66
|
+
email: r.email ?? null,
|
|
67
|
+
}));
|
|
68
|
+
}
|
|
69
|
+
//# sourceMappingURL=member-directory.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"member-directory.js","sourceRoot":"","sources":["../src/member-directory.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,6FAA6F;AAC7F,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGpE,MAAM,CAAC,MAAM,UAAU,GAAa;IAClC;;;0FAGwF;IACxF,iEAAiE;CAClE,CAAC;AAEF,qGAAqG;AACrG,MAAM,CAAC,MAAM,oBAAoB,GAAsB,CAAC,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC,CAAC;AAQ1F,MAAM,WAAW,GAAG,CAAC,CAA0B,EAAa,EAAE,CAAC,CAAC;IAC9D,SAAS,EAAE,CAAC,CAAC,SAAmB;IAChC,OAAO,EAAE,CAAC,CAAC,QAAkB;IAC7B,KAAK,EAAG,CAAC,CAAC,KAAuB,IAAI,IAAI;IACzC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,UAAU,YAAY,CAC1B,GAAgB,EAAE,OAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAoB,EAAE,SAAiB;IAE9G,GAAG,CAAC,IAAI,CACN,8FAA8F,EAC9F,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAC9C,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,GAAgB,EAAE,OAAe;IAC3D,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CACjB,uHAAuH,EACvH,OAAO,CACR,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACtB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CACpB,gHAAgH,EAChH,OAAO,EAAE,SAAS,CACnB,CAAC,CAAC,CAAC,CAAC,CAAC;IACN,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAC/E,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,4EAA4E,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACpI,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAC/E,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB;IAC3F,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,oFAAoF,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvI,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACrH,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACpG,OAAO,GAAG,CAAC,SAAmB,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAgB,EAAE,OAAe;IAClE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CACjB;;;;6CAIyC,EACzC,OAAO,EAAE,OAAO,CACjB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACb,SAAS,EAAE,CAAC,CAAC,SAAmB;QAChC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,KAAK,EAAG,CAAC,CAAC,KAAuB,IAAI,IAAI;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@substrat-run/vertical-auth",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.20.0",
|
|
4
4
|
"description": "Pluggable auth for Substrat verticals — the AuthProvider contract, an OIDC provider (Supabase/Auth0/AuthHero/Keycloak), a full relying-party login flow, and a per-tenant identity Durable Object (Better Auth + sub→principal directory). Workers-targeted; the vertical worker bundles it.",
|
|
5
5
|
"license": "AGPL-3.0-only",
|
|
6
6
|
"repository": {
|
|
@@ -36,6 +36,10 @@
|
|
|
36
36
|
"types": "./dist/invite-routes.d.ts",
|
|
37
37
|
"default": "./dist/invite-routes.js"
|
|
38
38
|
},
|
|
39
|
+
"./member-directory": {
|
|
40
|
+
"types": "./dist/member-directory.d.ts",
|
|
41
|
+
"default": "./dist/member-directory.js"
|
|
42
|
+
},
|
|
39
43
|
"./owner-claim-routes": {
|
|
40
44
|
"types": "./dist/owner-claim-routes.d.ts",
|
|
41
45
|
"default": "./dist/owner-claim-routes.js"
|
|
@@ -48,10 +52,10 @@
|
|
|
48
52
|
"better-auth": "^1.7.1",
|
|
49
53
|
"drizzle-orm": "^0.45.2",
|
|
50
54
|
"jose": "^6.2.3",
|
|
51
|
-
"@substrat-run/contracts": "^0.
|
|
55
|
+
"@substrat-run/contracts": "^0.139.0",
|
|
56
|
+
"@substrat-run/kernel": "^0.139.0",
|
|
52
57
|
"@substrat-run/oidc-rp": "^0.10.0",
|
|
53
|
-
"@substrat-run/psl": "^0.2.5"
|
|
54
|
-
"@substrat-run/kernel": "^0.138.0"
|
|
58
|
+
"@substrat-run/psl": "^0.2.5"
|
|
55
59
|
},
|
|
56
60
|
"peerDependencies": {
|
|
57
61
|
"hono": "^4.13.12"
|