@tatara/cli 0.12.0 → 0.13.0

package/dist/bin.mjs

@@ -84,6 +84,18 @@ const authz = {
 	label: "Permission system",
 	dependencies: ["@tatara/authz"],
 	slots: [
+		{
+			file: "src/core/authz/system-roles.ts",
+			slot: "admin",
+			unless: ["auth-keycloak"],
+			content: "{ key: \"admin\", name: \"Admin\", description: \"Full access, including roles and members.\" },"
+		},
+		{
+			file: "src/core/authz/system-roles.ts",
+			slot: "admin",
+			when: ["auth-keycloak"],
+			content: "{ key: \"admin\", name: \"Admin\", description: \"Full access, including roles and members.\", heldBy: \"identity\" },"
+		},
 		{
 			file: "src/core/authz/index.ts",
 			slot: "options",
@@ -136,8 +148,11 @@ const authz = {
 - Guard routes with \`middleware: [requirePermission("project:read")]\` from \`#core/authz/index\`
   and declare \`security: [{ bearerAuth: ["project:read"] }]\`. For scoped actions, call
   \`resolveScope(principal, "doc:read")\` in the service and filter rows by the returned scope.
-- Effective permissions = role grants (assigned roles + built-in roles whose key matches an
-  identity-provider role) + grant overlays − deny overlays. Deny always wins.
+- Effective permissions = grants of the caller's roles + grant overlays − deny overlays. Deny
+  always wins. Roles are assigned in authz (the org's creator gets \`admin\`); a built-in role with
+  \`heldBy: "members"\` goes to every member, \`heldBy: "identity"\` to holders of that identity role.
+- better-auth's member role is membership only (\`owner\` or \`member\`): \`authzPlugin\` in
+  \`src/modules/users/services/auth.ts\` refuses others and gives the creator \`admin\`.
 - Custom roles and grant overlays can never grant \`role\`, \`member\` or \`audit_log\`.
 - Built-in roles live in \`src/core/authz/system-roles.ts\`. \`authz:sync-permissions\` brings the database
   in line with them; \`deploy\` runs it every deploy, \`db:seed\` locally.
@@ -476,7 +491,7 @@ const admin = {
 		{
 			file: "src/core/authz/system-roles.ts",
 			slot: "roles",
-			content: "{ key: \"staff\", name: \"Staff\", description: \"Internal staff: platform permissions on the admin app.\" },"
+			content: "{ key: \"staff\", name: \"Staff\", description: \"Internal staff: platform permissions on the admin app.\", heldBy: \"identity\" },"
 		},
 		{
 			file: "src/modules/staff/services/auth.ts",
@@ -1546,16 +1561,15 @@ const authOrgs = {
 			slot: "plugins",
 			when: ["authz"],
 			content: [
-				"organization({",
-				"	organizationHooks: {",
-				"		// whoever creates an org administers it (pick another built-in role, or drop this)",
-				"		afterCreateOrganization: async ({ organization, member }) => {",
-				"			await authz.grantSystemRole(organization.id, member.userId, \"admin\", member.userId);",
-				"		},",
-				"		// authz roles and overlays go with the membership, so re-adding someone starts clean",
-				"		afterRemoveMember: async ({ member }) => {",
-				"			await authz.removeMemberAccess(member.organizationId, member.userId);",
-				"		},",
+				"organization(),",
+				"// better-auth keeps who is in which org (owner or member); authz decides what they may do.",
+				"// The creator gets admin (`creatorRole`). better-auth shows these lists, emails included,",
+				"// to any member: `endpoints` puts them behind an authz permission",
+				"authzPlugin(authz, {",
+				"	endpoints: {",
+				"		\"/organization/list-members\": \"member:read\",",
+				"		\"/organization/get-full-organization\": \"member:read\",",
+				"		\"/organization/list-invitations\": \"member:read\",",
 				"	},",
 				"}),",
 				"admin(),"
@@ -1566,7 +1580,7 @@ const authOrgs = {
 			file: "src/modules/users/services/auth.ts",
 			slot: "imports",
 			when: ["authz"],
-			content: "import { authz } from \"#core/authz/index\";"
+			content: "import { authzPlugin } from \"@tatara/authz/better-auth\";\nimport { authz } from \"#core/authz/index\";"
 		},
 		{
 			file: "tests/helpers/auth.ts",
@@ -3484,6 +3498,41 @@ const authzPackage = {
 	}
 };
 //#endregion
+//#region src/upgrade/codemods/authz-roles.ts
+const PATH = "src/core/authz/system-roles.ts";
+/** Adds `heldBy` to the role literal `{ key: "<key>", … }`, unless it has one. */
+function holdRole(text, key, heldBy) {
+	const start = text.search(new RegExp(`\\{\\s*key:\\s*"${key}"`));
+	if (start === -1) return text;
+	const end = text.indexOf("}", start);
+	if (end === -1) return text;
+	const literal = text.slice(start, end);
+	if (literal.includes("heldBy")) return text;
+	const body = literal.replace(/,?\s*$/, "");
+	return `${text.slice(0, start)}${body}, heldBy: "${heldBy}" ${text.slice(end)}`;
+}
+/** Roles only follow better-auth's member or user role where the app says so (`heldBy`). */
+const authzRoles = {
+	version: "0.13.0",
+	id: "authz-roles",
+	description: "Built-in roles say who holds them (heldBy); better-auth's member role is membership only",
+	async run(ctx) {
+		const { config } = ctx.project;
+		if (!config.addons.includes("authz")) return;
+		const text = await ctx.read(PATH).catch(() => void 0);
+		if (text !== void 0) {
+			let next = holdRole(text, "member", "members");
+			next = holdRole(next, "staff", "identity");
+			if (config.authMethods.includes("keycloak")) {
+				for (const [, key] of text.matchAll(/\{\s*key:\s*"([^"]+)"/g)) if (key && key !== "member") next = holdRole(next, key, "identity");
+			}
+			if (next !== text) await ctx.write(PATH, next);
+		}
+		ctx.report.notes.push("Built-in roles no longer follow better-auth's member role (or the user role, unless the role has heldBy: \"identity\"). Give access with authz roles (grantSystemRole, assignRole); `member` is held by every member (heldBy: \"members\").");
+		if (config.authMethods.includes("orgs")) ctx.report.notes.push("In src/modules/users/services/auth.ts, replace the organizationHooks that grant the creator's role and remove member access with authzPlugin(authz, { endpoints: { \"/organization/list-members\": \"member:read\", \"/organization/get-full-organization\": \"member:read\", \"/organization/list-invitations\": \"member:read\" } }) from @tatara/authz/better-auth, after organization(). It also keeps member roles to owner and member.");
+	}
+};
+//#endregion
 //#region src/upgrade/codemods/authz-stores.ts
 const group = {
 	name: "authz store",
@@ -3985,7 +4034,8 @@ const CODEMODS = [
 	httpLimits,
 	jobsDrivers,
 	emailV2,
-	deployLedger
+	deployLedger,
+	authzRoles
 ];
 //#endregion
 //#region src/upgrade/context.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tatara/cli",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Create and grow opinionated Hono backends",
   "type": "module",
   "license": "MIT",

package/templates/features/authz/files/src/core/authz/system-roles.ts

@@ -1,7 +1,10 @@
-/** Built-in roles. Add a key here, then grant it permissions in module permission files. */
+/**
+ * Built-in roles. Add a key here, then grant it permissions in module permission files. A role is
+ * held only by those it's assigned to, unless `heldBy` says every org member or an identity role.
+ */
 export const SYSTEM_ROLES = [
-	{ key: "admin", name: "Admin", description: "Full access, including roles and members." },
-	{ key: "member", name: "Member", description: "Default role for every member." },
+	// tatara:slot admin
+	{ key: "member", name: "Member", description: "Every member of the org.", heldBy: "members" },
 	// tatara:slot roles
 ] as const;
 

package/templates/versions.json

@@ -35,9 +35,9 @@
   "@tatara/http": "0.1.2",
   "@tatara/db": "0.2.2",
   "@tatara/testing": "0.1.1",
-  "@tatara/auth": "0.2.0",
+  "@tatara/auth": "0.2.1",
   "@tatara/keycloak": "0.1.2",
-  "@tatara/authz": "0.4.0",
+  "@tatara/authz": "0.5.0",
   "@tatara/storage": "0.2.0",
   "@tatara/email": "0.3.0",
   "@tatara/i18n": "0.1.0",