@tatara/cli 0.11.1 → 0.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tatara/cli",
-  "version": "0.11.1",
+  "version": "0.13.0",
   "description": "Create and grow opinionated Hono backends",
   "type": "module",
   "license": "MIT",

package/templates/features/authz/files/src/core/authz/system-roles.ts

@@ -1,7 +1,10 @@
-/** Built-in roles. Add a key here, then grant it permissions in module permission files. */
+/**
+ * Built-in roles. Add a key here, then grant it permissions in module permission files. A role is
+ * held only by those it's assigned to, unless `heldBy` says every org member or an identity role.
+ */
 export const SYSTEM_ROLES = [
-	{ key: "admin", name: "Admin", description: "Full access, including roles and members." },
-	{ key: "member", name: "Member", description: "Default role for every member." },
+	// tatara:slot admin
+	{ key: "member", name: "Member", description: "Every member of the org.", heldBy: "members" },
 	// tatara:slot roles
 ] as const;
 

package/templates/features/authz/files+auth-orgs/tests/tatara/authz-org-creator.test.ts

@@ -0,0 +1,26 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import { authz } from "#core/authz/index";
+import { api } from "#tests/helpers/api";
+import { authenticate } from "#tests/helpers/auth";
+import { resetDatabase } from "#tests/helpers/db";
+
+beforeEach(async () => {
+	await resetDatabase();
+	await authz.syncSystemRoles();
+});
+
+describe("an organization's creator", () => {
+	it("is its admin", async () => {
+		const user = await authenticate();
+		const created = await api.post<{ id: string }>(
+			"/api/auth/organization/create",
+			{ name: "New School", slug: `new-${crypto.randomUUID()}` },
+			{ headers: user.headers },
+		);
+		expect(created.status).toBe(200);
+		const me = await api.get<{ data: { roles: string[] } }>("/api/authorization/me", {
+			headers: { ...user.headers, "x-org-id": created.body.id },
+		});
+		expect(me.body.data.roles).toContain("admin");
+	});
+});

package/templates/features/base/files/AGENTS.md

@@ -41,6 +41,7 @@ __PM_EXEC__ tatara make route|service|command <name> --module <module>
 __PM_EXEC__ tatara run --list            # app commands
 __PM_EXEC__ tatara routes                # every route and what protects it
 __PM_EXEC__ tatara upgrade               # after bumping @tatara/cli: run its codemods, sync, verify
+__PM_EXEC__ tatara add <add-on…>         # add jobs, cache, realtime… to this app later
 ```
 
 ## HTTP
@@ -73,6 +74,8 @@ __PM_EXEC__ tatara upgrade               # after bumping @tatara/cli: run its co
   Never `Math.random()` for anything a user could guess.
 - User text: `text({ max })` and `url()` from `@tatara/core` in validators clean and check it (control,
   invisible and bidi characters, whitespace; only http(s) links). Escape when you render HTML.
+  Rich text users write: `sanitizeHtml(html)` (or `"email"` for templates) from `@tatara/core/html`
+  once `sanitize-html` is a dependency.
 
 ## Deploying
 

package/templates/features/notifications/files/src/modules/notifications/services/notifier.ts

@@ -52,6 +52,9 @@ export const { notify, consumers } = createNotifier<NotificationsOf<typeof notif
 			? { email: user.email ?? null, phone: user.phoneNumber ?? null, language: user.language ?? null }
 			: null;
 	},
+	// who gets what is yours to decide: preferences, quiet hours… ({ userId, notification, channel,
+	// data }); false skips that channel for that user
+	allow: () => true,
 	sms: sms(),
 	push: push(),
 	// tatara:slot senders

package/templates/features/observability/files/src/apps/instrument.ts

@@ -1,11 +1,10 @@
 // Loaded before the app (`node --import ./dist/apps/instrument.mjs …`, set in the Dockerfile):
 // instrumentation can only patch libraries imported after it, so app code comes in dynamically.
-import { register } from "node:module";
-
 const { env } = await import("#core/config/env");
 
 if (env.OTEL_EXPORTER_OTLP_ENDPOINT) {
-	register("@opentelemetry/instrumentation/hook.mjs", import.meta.url);
+	const { registerInstrumentationHooks } = await import("@tatara/observability/hooks");
+	await registerInstrumentationHooks();
 	const { startTelemetry } = await import("@tatara/observability");
 	startTelemetry({
 		serviceName: env.OTEL_SERVICE_NAME,

package/templates/versions.json

@@ -31,13 +31,13 @@
   "@aws-sdk/s3-request-presigner": "3.1152.0",
   "nodemailer": "10.1.1",
   "@types/nodemailer": "8.0.2",
-  "@tatara/core": "0.1.2",
+  "@tatara/core": "0.1.3",
   "@tatara/http": "0.1.2",
   "@tatara/db": "0.2.2",
   "@tatara/testing": "0.1.1",
-  "@tatara/auth": "0.2.0",
+  "@tatara/auth": "0.2.1",
   "@tatara/keycloak": "0.1.2",
-  "@tatara/authz": "0.3.1",
+  "@tatara/authz": "0.5.0",
   "@tatara/storage": "0.2.0",
   "@tatara/email": "0.3.0",
   "@tatara/i18n": "0.1.0",
@@ -45,13 +45,13 @@
   "@tatara/cache": "0.1.0",
   "openapi-typescript": "7.13.0",
   "kafkajs": "2.2.4",
-  "@tatara/notifications": "0.1.0",
+  "@tatara/notifications": "0.2.0",
   "@tatara/realtime": "0.1.0",
   "socket.io": "4.8.4",
   "socket.io-client": "4.8.4",
   "@socket.io/redis-adapter": "8.3.0",
   "@socket.io/redis-emitter": "5.1.0",
-  "@tatara/observability": "0.1.0",
+  "@tatara/observability": "0.2.0",
   "@opentelemetry/api": "1.10.0",
   "@opentelemetry/sdk-node": "0.300.0",
   "@opentelemetry/sdk-trace": "3.0.0",
@@ -61,5 +61,6 @@
   "@opentelemetry/exporter-metrics-otlp-http": "0.300.0",
   "@opentelemetry/auto-instrumentations-node": "0.82.0",
   "@opentelemetry/instrumentation": "0.300.0",
-  "@hono/otel": "1.3.0"
+  "@hono/otel": "1.3.0",
+  "import-in-the-middle": "3.5.3"
 }