@tatara/cli 0.13.0 → 0.13.2

package/dist/bin.mjs

@@ -531,22 +531,6 @@ const admin = {
 		}
 	]
 };
-const MEMBERS = `/** The org's members, a page at a time. */
-async function* members(orgId: string) {
-	const { adapter } = await auth.$context;
-	for (let offset = 0; ; offset += 100) {
-		const page = await adapter.findMany<{ userId: string; role: string }>({
-			model: "member",
-			where: [{ field: "organizationId", value: orgId }],
-			limit: 100,
-			offset,
-			sortBy: { field: "id", direction: "asc" },
-		});
-		yield* page;
-		if (page.length < 100) return;
-	}
-}`;
-const hasRole = "m.role.split(\",\").map((r) => r.trim()).includes(role)";
 const notifications = {
 	id: "notifications",
 	kind: "addon",
@@ -621,7 +605,21 @@ const notifications = {
 			file: "src/modules/notifications/services/notifier.ts",
 			slot: "helpers",
 			when: ["auth-orgs"],
-			content: MEMBERS
+			content: `/** The org's members, a page at a time. */
+async function* members(orgId: string) {
+	const { adapter } = await auth.$context;
+	for (let offset = 0; ; offset += 100) {
+		const page = await adapter.findMany<{ userId: string; role: string }>({
+			model: "member",
+			where: [{ field: "organizationId", value: orgId }],
+			limit: 100,
+			offset,
+			sortBy: { field: "id", direction: "asc" },
+		});
+		yield* page;
+		if (page.length < 100) return;
+	}
+}`
 		},
 		{
 			file: "src/modules/notifications/services/notifier.ts",
@@ -631,7 +629,7 @@ const notifications = {
 			content: [
 				"recipients: {",
 				"	async *role(orgId, role) {",
-				`\t\tfor await (const m of members(orgId)) if (${hasRole}) yield m.userId;`,
+				`\t\tfor await (const m of members(orgId)) if (m.role.split(",").map((r) => r.trim()).includes(role)) yield m.userId;`,
 				"	},",
 				"	permission() {",
 				"		throw new Error(\"Notifying by permission needs the authz add-on\");",
@@ -645,8 +643,12 @@ const notifications = {
 			when: ["auth-orgs", "authz"],
 			content: [
 				"recipients: {",
+				"	// authz roles (assigned, or held by every member): better-auth's member role is only owner or member",
 				"	async *role(orgId, role) {",
-				`\t\tfor await (const m of members(orgId)) if (${hasRole}) yield m.userId;`,
+				"		for await (const m of members(orgId)) {",
+				"			const who = { userId: m.userId, orgId, orgRole: m.role, roles: [], kind: \"user\" as const, claims: {} };",
+				"			if ((await authz.effectivePermissions(who)).roles.includes(role)) yield m.userId;",
+				"		}",
 				"	},",
 				"	// the same check a request makes: built-in roles, assigned roles and overlays",
 				"	async *permission(orgId, permission) {",
@@ -662,7 +664,7 @@ const notifications = {
 			file: "src/modules/notifications/services/notifier.ts",
 			slot: "imports",
 			when: ["auth-orgs", "authz"],
-			content: "import { checkPermission } from \"#core/authz/index\";\nimport type { PermissionKey } from \"#generated/permissions\";"
+			content: "import { authz, checkPermission } from \"#core/authz/index\";\nimport type { PermissionKey } from \"#generated/permissions\";"
 		},
 		{
 			file: "src/modules/notifications/services/notifier.ts",
@@ -3983,6 +3985,30 @@ const jobsDrivers = {
 	}
 };
 //#endregion
+//#region src/upgrade/codemods/notifier-roles.ts
+const NOTIFIER = "src/modules/notifications/services/notifier.ts";
+const TEST = "src/modules/notifications/tests/role-recipients.test.ts";
+/** `recipients.role` reads authz roles: better-auth's member role is only owner or member. */
+const notifierRoles = {
+	version: "0.13.1",
+	id: "notifier-roles",
+	description: "Notifying by role reaches holders of the authz role",
+	async run(ctx) {
+		const { config } = ctx.project;
+		const addons = config.addons;
+		if (!addons.includes("notifications") || !addons.includes("authz")) return;
+		if (!config.authMethods.includes("orgs")) return;
+		const text = await ctx.read(NOTIFIER).catch(() => void 0);
+		if (text === void 0) return;
+		if (await ctx.baseline.isUnchanged(NOTIFIER, text)) await ctx.regenerate(NOTIFIER);
+		else ctx.report.notes.push(`In ${NOTIFIER}, recipients.role should check authz roles: \`(await authz.effectivePermissions(who)).roles.includes(role)\` for each member, with who as in recipients.permission. Matching member.role finds nobody now that it is only owner or member.`);
+		if (await ctx.read(TEST).catch(() => void 0) === void 0) {
+			const test = await ctx.renderCurrent(TEST);
+			if (test !== void 0) await ctx.write(TEST, test);
+		}
+	}
+};
+//#endregion
 //#region src/upgrade/codemods/package-commands.ts
 /** Copies whose commands and seeds the packages contribute now (wired by `tatara sync`). */
 const COPIES = [
@@ -4035,7 +4061,8 @@ const CODEMODS = [
 	jobsDrivers,
 	emailV2,
 	deployLedger,
-	authzRoles
+	authzRoles,
+	notifierRoles
 ];
 //#endregion
 //#region src/upgrade/context.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tatara/cli",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "Create and grow opinionated Hono backends",
   "type": "module",
   "license": "MIT",

package/templates/features/base/files/src/apps/http.ts

@@ -1,4 +1,5 @@
-import { createApp, handleErrors, mountRoutes, serveOpenApi } from "@tatara/http";
+import { corsOrigin, createApp, handleErrors, mountRoutes, serveOpenApi } from "@tatara/http";
+import { cors } from "hono/cors";
 import { env } from "#core/config/env";
 import type { AppEnv } from "#core/http/context";
 import type { AppName } from "#core/http/routes";
@@ -12,13 +13,6 @@ export const API_PREFIX = "/api";
 export function createHttpApp(name: AppName, options: { title: string }) {
 	const app = createApp<AppEnv>({
 		logger,
-		cors: {
-			origins: env.CORS_ORIGINS,
-			exposeHeaders: [
-				"X-Request-Id",
-				// tatara:slot expose-headers
-			],
-		},
 		bodyLimitBytes: env.BODY_LIMIT_BYTES,
 		timeouts: {
 			defaultMs: env.REQUEST_TIMEOUT_MS,
@@ -28,6 +22,25 @@ export function createHttpApp(name: AppName, options: { title: string }) {
 		},
 		defaults: { principal: null, language: "en" },
 	});
+	// browsers on other origins (Hono's own middleware); corsOrigin matches exact origins and
+	// one-label patterns like https://*.example.com
+	app.use(
+		cors({
+			origin: corsOrigin(env.CORS_ORIGINS),
+			credentials: true,
+			allowHeaders: [
+				"Content-Type",
+				"Authorization",
+				"X-Request-Id",
+				"Accept-Language",
+				// tatara:slot allow-headers
+			],
+			exposeHeaders: [
+				"X-Request-Id",
+				// tatara:slot expose-headers
+			],
+		}),
+	);
 	// tatara:slot middleware
 
 	// tatara:slot routes

package/templates/features/notifications/files+auth-orgs+authz/src/modules/notifications/tests/role-recipients.test.ts

@@ -0,0 +1,34 @@
+import type { InlineDriver } from "@tatara/jobs";
+import { beforeEach, describe, expect, it } from "vitest";
+import { jobs } from "#core/jobs/index";
+import { notify } from "#modules/notifications/services/notifier";
+import { api } from "#tests/helpers/api";
+import { authenticate } from "#tests/helpers/auth";
+import { applyTestAccess } from "#tests/helpers/authz";
+import { resetDatabase } from "#tests/helpers/db";
+
+const drain = () => (jobs.driver as InlineDriver).drain();
+
+beforeEach(async () => {
+	await resetDatabase();
+});
+
+describe("notifying by role", () => {
+	it("reaches the members who hold the authz role, not better-auth's member role", async () => {
+		const admin = await authenticate();
+		await applyTestAccess(admin.userId, { systemRoles: ["admin"], orgId: admin.orgId });
+		const plain = await authenticate();
+		await notify({
+			orgId: admin.orgId as string,
+			to: { role: "admin" },
+			notification: "example.welcome",
+			data: { name: "Ada" },
+		});
+		await drain();
+		const count = async (headers: Record<string, string>) =>
+			(await api.get<{ data: { count: number } }>("/api/notifications/unread-count", { headers }))
+				.body.data.count;
+		expect(await count(admin.headers)).toBe(1);
+		expect(await count(plain.headers)).toBe(0);
+	});
+});

package/templates/versions.json

@@ -32,12 +32,12 @@
   "nodemailer": "10.1.1",
   "@types/nodemailer": "8.0.2",
   "@tatara/core": "0.1.3",
-  "@tatara/http": "0.1.2",
+  "@tatara/http": "0.1.4",
   "@tatara/db": "0.2.2",
   "@tatara/testing": "0.1.1",
   "@tatara/auth": "0.2.1",
   "@tatara/keycloak": "0.1.2",
-  "@tatara/authz": "0.5.0",
+  "@tatara/authz": "0.5.2",
   "@tatara/storage": "0.2.0",
   "@tatara/email": "0.3.0",
   "@tatara/i18n": "0.1.0",