@tatara/cli 0.9.1 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tatara/cli",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "Create and grow opinionated Hono backends",
   "type": "module",
   "license": "MIT",

package/templates/features/admin/files/src/apps/admin/app.ts

@@ -1,4 +1,4 @@
-import { createHttpApp } from "#core/http/app";
+import { createHttpApp } from "#apps/http";
 
 /** Internal/staff API on its own port; every /api route requires the admin role. */
 export const app = createHttpApp("admin", { title: "__APP_NAME__ admin API" });

package/templates/features/admin/files/src/modules/example/routes/admin-greeting.routes.ts

@@ -11,8 +11,8 @@ router.openapi(
 		method: "get",
 		path: "/",
 		tags: ["Example"],
-		summary: "Greet the signed-in admin",
-		security: [{ bearerAuth: ["admin"] }],
+		summary: "Greet the signed-in staff member",
+		security: [{ bearerAuth: ["staff"] }],
 		responses: {
 			200: jsonContent(successSchema(greetingSchema), "A greeting"),
 			...errorResponses(401, 403),

package/templates/features/admin/files/src/modules/example/tests/admin.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vitest";
 import { adminApi } from "#tests/helpers/api";
 import { asUser } from "#tests/helpers/auth";
+import { asStaff } from "#tests/helpers/staff";
 
 describe("admin app", () => {
 	it("requires authentication", async () => {
@@ -8,13 +9,19 @@ describe("admin app", () => {
 		expect(res.status).toBe(401);
 	});
 
-	it("forbids users without the admin role", async () => {
-		const res = await adminApi.get("/api/greetings", { headers: await asUser() });
+	it("refuses users: the admin app is for staff", async () => {
+		const res = await adminApi.get("/api/greetings", { headers: await asUser({ roles: ["admin"] }) });
+		// a users session isn't known here (401); a Keycloak token without the staff role is (403)
+		expect([401, 403]).toContain(res.status);
+	});
+
+	it("forbids staff without the staff role", async () => {
+		const res = await adminApi.get("/api/greetings", { headers: await asStaff({ role: "intern" }) });
 		expect(res.status).toBe(403);
 	});
 
-	it("serves admins", async () => {
-		const res = await adminApi.get("/api/greetings", { headers: await asUser({ roles: ["admin"] }) });
+	it("serves staff", async () => {
+		const res = await adminApi.get("/api/greetings", { headers: await asStaff() });
 		expect(res.status).toBe(200);
 	});
 });

package/templates/features/admin/files/src/modules/staff/db/seed.ts

@@ -0,0 +1,27 @@
+import { defineSeed } from "@tatara/db";
+import { env } from "#core/config/env";
+import { staffAuth } from "#modules/staff/services/auth";
+
+/** Development staff account for the admin app (never created in production). */
+export default defineSeed({
+	name: "staff:dev-admin",
+	order: 0,
+	async run({ logger }) {
+		if (env.NODE_ENV !== "development" && env.NODE_ENV !== "test") return;
+		if (!env.SEED_STAFF_PASSWORD) return;
+		const ctx = await staffAuth.$context;
+		const email = env.SEED_STAFF_EMAIL;
+		if (await ctx.internalAdapter.findUserByEmail(email)) return;
+		const user = await ctx.internalAdapter.createUser(
+			{ email, name: "Dev staff", emailVerified: true, role: "staff" },
+			{ method: "admin" },
+		);
+		await ctx.internalAdapter.linkAccount({
+			userId: user.id,
+			providerId: "credential",
+			accountId: user.id,
+			password: await ctx.password.hash(env.SEED_STAFF_PASSWORD),
+		});
+		logger.info({ email, userId: user.id }, "created development staff account");
+	},
+});

package/templates/features/admin/files/src/modules/staff/services/auth.ts

@@ -0,0 +1,46 @@
+import { createAuthInstance } from "@tatara/auth";
+import { newId } from "@tatara/db";
+import { bearer, openAPI } from "better-auth/plugins";
+import { env } from "#core/config/env";
+import { staffDatabase } from "#modules/staff/services/adapter";
+// tatara:slot imports
+
+/** Every staff principal acts in this org, so platform permissions never mix with a customer org's. */
+export const PLATFORM_ORG_ID = "platform";
+
+/**
+ * A separate better-auth for internal staff, mounted on the admin app only. Staff and users never
+ * share a table, a session or a cookie. There's no sign-up: staff accounts come from the seed or
+ * a command.
+ */
+export const { auth: staffAuth, attachPrincipal: attachStaffPrincipal } = createAuthInstance(
+	{
+		appName: "__APP_NAME__ staff",
+		baseURL: env.ADMIN_URL,
+		basePath: "/api/auth",
+		secret: env.BETTER_AUTH_SECRET,
+		trustedOrigins: env.CORS_ORIGINS,
+		database: staffDatabase,
+		user: {
+			modelName: "staffUser",
+			additionalFields: { role: { type: "string", defaultValue: "staff", input: false } },
+		},
+		session: { modelName: "staffSession" },
+		account: { modelName: "staffAccount" },
+		verification: { modelName: "staffVerification" },
+		advanced: { database: { generateId: () => newId() }, cookiePrefix: "staff" },
+		emailAndPassword: { enabled: true, minPasswordLength: 10, disableSignUp: true },
+		plugins: [
+			// Authorization: Bearer <session token> for API clients
+			bearer(),
+			// reference for the staff auth endpoints at /api/auth/reference on the admin app
+			openAPI(),
+		],
+	},
+	{
+		org: PLATFORM_ORG_ID,
+		resolvers: [
+			// tatara:slot resolvers
+		],
+	},
+);

package/templates/features/admin/files/tests/helpers/staff.ts

@@ -0,0 +1,8 @@
+import { createTestUser, sessionHeaders } from "@tatara/auth/testing";
+import { staffAuth } from "#modules/staff/services/auth";
+
+/** Headers that authenticate as a new staff member on the admin app. */
+export async function asStaff(options: { role?: string } = {}): Promise<Record<string, string>> {
+	const userId = await createTestUser(staffAuth, { fields: { role: options.role ?? "staff" } });
+	return sessionHeaders(staffAuth, userId);
+}

package/templates/features/admin/files+drizzle+mysql/src/modules/staff/db/staff.schema.ts

@@ -0,0 +1,58 @@
+// Internal staff accounts: better-auth's tables under staff_* names, apart from users.
+import { boolean, mysqlTable, text, timestamp, varchar } from "drizzle-orm/mysql-core";
+
+const id = () => varchar({ length: 36 });
+const createdAt = () => timestamp({ fsp: 3, mode: "date" }).notNull().defaultNow();
+const updatedAt = () => timestamp({ fsp: 3, mode: "date" }).notNull().defaultNow();
+
+export const staffUsers = mysqlTable("staff_users", {
+	id: id().primaryKey(),
+	name: varchar({ length: 255 }).notNull(),
+	email: varchar({ length: 255 }).notNull().unique(),
+	emailVerified: boolean().notNull().default(false),
+	image: text(),
+	/** staff role, e.g. "staff"; the admin app requires one */
+	role: varchar({ length: 64 }).notNull().default("staff"),
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});
+
+export const staffSessions = mysqlTable("staff_sessions", {
+	id: id().primaryKey(),
+	expiresAt: timestamp({ fsp: 3, mode: "date" }).notNull(),
+	token: varchar({ length: 255 }).notNull().unique(),
+	ipAddress: varchar({ length: 64 }),
+	userAgent: text(),
+	userId: id()
+		.notNull()
+		.references(() => staffUsers.id, { onDelete: "cascade" }),
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});
+
+export const staffAccounts = mysqlTable("staff_accounts", {
+	id: id().primaryKey(),
+	accountId: varchar({ length: 255 }).notNull(),
+	providerId: varchar({ length: 64 }).notNull(),
+	userId: id()
+		.notNull()
+		.references(() => staffUsers.id, { onDelete: "cascade" }),
+	accessToken: text(),
+	refreshToken: text(),
+	idToken: text(),
+	accessTokenExpiresAt: timestamp({ fsp: 3, mode: "date" }),
+	refreshTokenExpiresAt: timestamp({ fsp: 3, mode: "date" }),
+	scope: text(),
+	password: text(),
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});
+
+export const staffVerifications = mysqlTable("staff_verifications", {
+	id: id().primaryKey(),
+	identifier: varchar({ length: 255 }).notNull(),
+	value: text().notNull(),
+	expiresAt: timestamp({ fsp: 3, mode: "date" }).notNull(),
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});

package/templates/features/admin/files+drizzle+mysql/src/modules/staff/services/adapter.ts

@@ -0,0 +1,13 @@
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { db } from "#core/db/client";
+import * as staff from "#modules/staff/db/staff.schema";
+
+export const staffDatabase = drizzleAdapter(db, {
+	provider: "mysql",
+	schema: {
+		staffUser: staff.staffUsers,
+		staffSession: staff.staffSessions,
+		staffAccount: staff.staffAccounts,
+		staffVerification: staff.staffVerifications,
+	},
+});

package/templates/features/admin/files+drizzle+postgres/src/modules/staff/db/staff.schema.ts

@@ -0,0 +1,57 @@
+// Internal staff accounts: better-auth's tables under staff_* names, apart from users.
+import { boolean, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+
+const createdAt = () => timestamp({ withTimezone: true, mode: "date" }).notNull().defaultNow();
+const updatedAt = () => timestamp({ withTimezone: true, mode: "date" }).notNull().defaultNow();
+
+export const staffUsers = pgTable("staff_users", {
+	id: text().primaryKey(),
+	name: text().notNull(),
+	email: text().notNull().unique(),
+	emailVerified: boolean().notNull().default(false),
+	image: text(),
+	/** staff role, e.g. "staff"; the admin app requires one */
+	role: text().notNull().default("staff"),
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});
+
+export const staffSessions = pgTable("staff_sessions", {
+	id: text().primaryKey(),
+	expiresAt: timestamp({ withTimezone: true, mode: "date" }).notNull(),
+	token: text().notNull().unique(),
+	ipAddress: text(),
+	userAgent: text(),
+	userId: text()
+		.notNull()
+		.references(() => staffUsers.id, { onDelete: "cascade" }),
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});
+
+export const staffAccounts = pgTable("staff_accounts", {
+	id: text().primaryKey(),
+	accountId: text().notNull(),
+	providerId: text().notNull(),
+	userId: text()
+		.notNull()
+		.references(() => staffUsers.id, { onDelete: "cascade" }),
+	accessToken: text(),
+	refreshToken: text(),
+	idToken: text(),
+	accessTokenExpiresAt: timestamp({ withTimezone: true, mode: "date" }),
+	refreshTokenExpiresAt: timestamp({ withTimezone: true, mode: "date" }),
+	scope: text(),
+	password: text(),
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});
+
+export const staffVerifications = pgTable("staff_verifications", {
+	id: text().primaryKey(),
+	identifier: text().notNull(),
+	value: text().notNull(),
+	expiresAt: timestamp({ withTimezone: true, mode: "date" }).notNull(),
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+});

package/templates/features/admin/files+drizzle+postgres/src/modules/staff/services/adapter.ts

@@ -0,0 +1,13 @@
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { db } from "#core/db/client";
+import * as staff from "#modules/staff/db/staff.schema";
+
+export const staffDatabase = drizzleAdapter(db, {
+	provider: "pg",
+	schema: {
+		staffUser: staff.staffUsers,
+		staffSession: staff.staffSessions,
+		staffAccount: staff.staffAccounts,
+		staffVerification: staff.staffVerifications,
+	},
+});

package/templates/features/admin/files+prisma/prisma/models/staff.prisma

@@ -0,0 +1,61 @@
+// Internal staff accounts: better-auth's tables under staff_* names, apart from users.
+
+model StaffUser {
+  id            String    @id @db.VarChar(36)
+  name          String    @db.VarChar(255)
+  email         String    @unique @db.VarChar(255)
+  emailVerified Boolean   @default(false) @map("email_verified")
+  image         String?   @db.Text
+  /// staff role, e.g. "staff"; the admin app requires one
+  role          String    @default("staff") @db.VarChar(64)
+  createdAt     DateTime  @default(now()) @map("created_at")
+  updatedAt     DateTime  @default(now()) @updatedAt @map("updated_at")
+  sessions      StaffSession[]
+  accounts      StaffAccount[]
+
+  @@map("staff_users")
+}
+
+model StaffSession {
+  id        String   @id @db.VarChar(36)
+  expiresAt DateTime @map("expires_at")
+  token     String   @unique @db.VarChar(255)
+  ipAddress String?  @map("ip_address") @db.VarChar(64)
+  userAgent String?  @map("user_agent") @db.Text
+  userId    String   @map("user_id") @db.VarChar(36)
+  user      StaffUser @relation(fields: [userId], references: [id], onDelete: Cascade)
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @default(now()) @updatedAt @map("updated_at")
+
+  @@map("staff_sessions")
+}
+
+model StaffAccount {
+  id                    String    @id @db.VarChar(36)
+  accountId             String    @map("account_id") @db.VarChar(255)
+  providerId            String    @map("provider_id") @db.VarChar(64)
+  userId                String    @map("user_id") @db.VarChar(36)
+  user      StaffUser @relation(fields: [userId], references: [id], onDelete: Cascade)
+  accessToken           String?   @map("access_token") @db.Text
+  refreshToken          String?   @map("refresh_token") @db.Text
+  idToken               String?   @map("id_token") @db.Text
+  accessTokenExpiresAt  DateTime? @map("access_token_expires_at")
+  refreshTokenExpiresAt DateTime? @map("refresh_token_expires_at")
+  scope                 String?   @db.Text
+  password              String?   @db.Text
+  createdAt             DateTime  @default(now()) @map("created_at")
+  updatedAt             DateTime  @default(now()) @updatedAt @map("updated_at")
+
+  @@map("staff_accounts")
+}
+
+model StaffVerification {
+  id         String   @id @db.VarChar(36)
+  identifier String   @db.VarChar(255)
+  value      String   @db.Text
+  expiresAt  DateTime @map("expires_at")
+  createdAt  DateTime @default(now()) @map("created_at")
+  updatedAt  DateTime @default(now()) @updatedAt @map("updated_at")
+
+  @@map("staff_verifications")
+}

package/templates/features/admin/files+prisma+mysql/src/modules/staff/services/adapter.ts

@@ -0,0 +1,5 @@
+import { prismaAdapter } from "better-auth/adapters/prisma";
+import { db } from "#core/db/client";
+
+/** The staff models in prisma/models/staff.prisma (better-auth's staffUser, staffSession, ...). */
+export const staffDatabase = prismaAdapter(db, { provider: "mysql" });

package/templates/features/admin/files+prisma+postgres/src/modules/staff/services/adapter.ts

@@ -0,0 +1,5 @@
+import { prismaAdapter } from "better-auth/adapters/prisma";
+import { db } from "#core/db/client";
+
+/** The staff models in prisma/models/staff.prisma (better-auth's staffUser, staffSession, ...). */
+export const staffDatabase = prismaAdapter(db, { provider: "postgresql" });

package/templates/features/auth-keycloak/files/keycloak/realm.json

@@ -7,8 +7,18 @@
 	"registrationAllowed": false,
 	"roles": {
 		"realm": [
-			{ "name": "user", "description": "Signed-in user" },
-			{ "name": "admin", "description": "Administrator" }
+			{
+				"name": "user",
+				"description": "Signed-in user"
+			},
+			{
+				"name": "admin",
+				"description": "Administrator"
+			},
+			{
+				"name": "staff",
+				"description": "Internal staff: can use the admin app"
+			}
 		]
 	},
 	"clients": [
@@ -28,9 +38,17 @@
 			"publicClient": true,
 			"standardFlowEnabled": true,
 			"directAccessGrantsEnabled": true,
-			"redirectUris": ["http://localhost:5173/*", "http://localhost:3000/*"],
-			"webOrigins": ["+"],
-			"attributes": { "pkce.code.challenge.method": "S256", "post.logout.redirect.uris": "+" },
+			"redirectUris": [
+				"http://localhost:5173/*",
+				"http://localhost:3000/*"
+			],
+			"webOrigins": [
+				"+"
+			],
+			"attributes": {
+				"pkce.code.challenge.method": "S256",
+				"post.logout.redirect.uris": "+"
+			},
 			"protocolMappers": [
 				{
 					"name": "api-audience",
@@ -66,8 +84,18 @@
 			"firstName": "Alice",
 			"lastName": "Admin",
 			"enabled": true,
-			"credentials": [{ "type": "password", "value": "alice", "temporary": false }],
-			"realmRoles": ["user", "admin"]
+			"credentials": [
+				{
+					"type": "password",
+					"value": "alice",
+					"temporary": false
+				}
+			],
+			"realmRoles": [
+				"user",
+				"admin",
+				"staff"
+			]
 		},
 		{
 			"username": "bob",
@@ -76,8 +104,41 @@
 			"firstName": "Bob",
 			"lastName": "User",
 			"enabled": true,
-			"credentials": [{ "type": "password", "value": "bob", "temporary": false }],
-			"realmRoles": ["user"]
+			"credentials": [
+				{
+					"type": "password",
+					"value": "bob",
+					"temporary": false
+				}
+			],
+			"realmRoles": [
+				"user"
+			]
+		}
+	],
+	"organizationsEnabled": true,
+	"organizations": [
+		{
+			"name": "Demo School",
+			"alias": "demo-school",
+			"enabled": true,
+			"description": "Dev organization: alice and bob are members",
+			"domains": [
+				{
+					"name": "demo-school.example",
+					"verified": false
+				}
+			],
+			"members": [
+				{
+					"username": "alice",
+					"membershipType": "UNMANAGED"
+				},
+				{
+					"username": "bob",
+					"membershipType": "UNMANAGED"
+				}
+			]
 		}
 	]
 }

package/templates/features/auth-keycloak/files/src/{core/auth → modules/users}/commands/keycloak-token.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { keycloak } from "#core/auth/keycloak";
+import { keycloak } from "#modules/users/services/keycloak";
 import { defineCommand } from "@tatara/core";
 import { env } from "#core/config/env";
 
@@ -21,6 +21,8 @@ export default defineCommand({
 				client_id: client,
 				username: user,
 				password: password ?? user,
+				// the organization scope puts the user's Keycloak organizations in the token
+				scope: "openid organization",
 			}),
 		});
 		const body = (await res.json()) as { access_token?: string; error_description?: string };

package/templates/features/auth-keycloak/files/{src/core/auth/tests/keycloak-tokens.test.ts → tests/tatara/auth-keycloak-tokens.test.ts}

@@ -1,7 +1,7 @@
 import { generateKeyPair, SignJWT } from "jose";
 import { beforeEach, describe, expect, it } from "vitest";
-import { auth } from "#core/auth/auth";
-import { keycloak } from "#core/auth/keycloak";
+import { auth } from "#modules/users/services/auth";
+import { keycloak } from "#modules/users/services/keycloak";
 import { env } from "#core/config/env";
 import { newId } from "@tatara/db";
 import { api } from "#tests/helpers/api";

package/templates/features/auth-keycloak/files+auth-orgs/{src/core/auth/tests/keycloak-organizations.test.ts → tests/tatara/auth-keycloak-organizations.test.ts}

@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it } from "vitest";
-import { auth } from "#core/auth/auth";
+import { auth } from "#modules/users/services/auth";
 import { newId } from "@tatara/db";
 import { api } from "#tests/helpers/api";
 import { keycloakToken } from "#tests/helpers/auth";

package/templates/features/auth-keycloak/files+authz/{src/core/auth/tests/keycloak-authz.test.ts → tests/tatara/auth-keycloak-authz.test.ts}

@@ -13,8 +13,9 @@ beforeEach(async () => {
 describe("Keycloak access tokens with authz", () => {
 	it("lets token roles match built-in authz roles", async () => {
 		await authz.syncSystemRoles();
-		const admin = await keycloakToken({ roles: ["admin"] });
-		const user = await keycloakToken({ roles: ["user"] });
+		// the token names its org, as Keycloak's organization claim does
+		const admin = await keycloakToken({ roles: ["admin"], organization: ["test-org"] });
+		const user = await keycloakToken({ roles: ["user"], organization: ["test-org"] });
 		expect((await api.get("/api/authorization/roles", { headers: bearer(admin) })).status).toBe(
 			200,
 		);

package/templates/features/auth-orgs/files+drizzle+mysql/src/{core/auth → modules/users}/db/organization.schema.ts

@@ -1,5 +1,5 @@
 import { mysqlTable, text, timestamp, varchar } from "drizzle-orm/mysql-core";
-import { users } from "#core/auth/db/auth.schema";
+import { users } from "#modules/users/db/auth.schema";
 
 export const organizations = mysqlTable("organizations", {
 	id: varchar({ length: 36 }).primaryKey(),

package/templates/features/auth-orgs/files+drizzle+postgres/src/{core/auth → modules/users}/db/organization.schema.ts

@@ -1,5 +1,5 @@
 import { pgTable, text, timestamp } from "drizzle-orm/pg-core";
-import { users } from "#core/auth/db/auth.schema";
+import { users } from "#modules/users/db/auth.schema";
 
 export const organizations = pgTable("organizations", {
 	id: text().primaryKey(),

package/templates/features/authz/files/src/core/authz/system-roles.ts

@@ -2,6 +2,7 @@
 export const SYSTEM_ROLES = [
 	{ key: "admin", name: "Admin", description: "Full access, including roles and members." },
 	{ key: "member", name: "Member", description: "Default role for every member." },
+	// tatara:slot roles
 ] as const;
 
 export type SystemRoleKey = (typeof SYSTEM_ROLES)[number]["key"];

package/templates/features/authz/files/src/{core/authz → modules/users}/routes/authorization.routes.ts

@@ -2,9 +2,12 @@ import { authorizationRoutes } from "@tatara/authz";
 import { authz } from "#core/authz/index";
 import type { AppEnv } from "#core/http/context";
 import { defineRoutes } from "#core/http/routes";
+// tatara:slot imports
 
 export default defineRoutes({
 	app: "api",
 	basePath: "/authorization",
-	router: authorizationRoutes<AppEnv>(authz),
+	router: authorizationRoutes<AppEnv>(authz, {
+		// tatara:slot route-options
+	}),
 });

package/templates/features/authz/files/{src/core/authz/tests → tests/tatara}/authz.test.ts

@@ -47,7 +47,8 @@ describe("/api/authorization", () => {
 			{ headers: await asUser({ systemRoles: ["admin"] }) },
 		);
 		expect(res.status).toBe(200);
-		expect(res.body.data.filter((r) => r.isSystem).map((r) => r.key)).toEqual(["admin", "member"]);
+		const builtIn = res.body.data.filter((r) => r.isSystem).map((r) => r.key);
+		expect(builtIn).toEqual(expect.arrayContaining(["admin", "member"]));
 	});
 
 	it("rejects custom roles that grant authorization itself", async () => {
@@ -127,7 +128,8 @@ describe("/api/authorization", () => {
 			{ headers: await asUser({ systemRoles: ["admin"] }) },
 		);
 		expect(res.status).toBe(200);
-		expect(res.body.data.roles).toEqual(["admin"]);
+		// with organizations the member's org role ("member") counts too
+		expect(res.body.data.roles).toContain("admin");
 		expect(res.body.data.grants.map((g) => g.resource)).toContain("audit_log");
 	});
 

package/templates/features/authz/files+drizzle/src/core/authz/index.ts

@@ -10,6 +10,7 @@ export const authz = createAuthz<PermissionKey>({
 	store: drizzleAuthzStore(db, tables),
 	catalog,
 	systemRoles: SYSTEM_ROLES,
+	// tatara:slot options
 });
 
 export const { checkPermission, removeMemberAccess, requirePermission, resolveScope } = authz;

package/templates/features/authz/files+prisma/src/core/authz/index.ts

@@ -9,6 +9,7 @@ export const authz = createAuthz<PermissionKey>({
 	store: prismaAuthzStore(db),
 	catalog,
 	systemRoles: SYSTEM_ROLES,
+	// tatara:slot options
 });
 
 export const { checkPermission, removeMemberAccess, requirePermission, resolveScope } = authz;

package/templates/features/base/files/src/apps/api/app.ts

@@ -1,3 +1,3 @@
-import { createHttpApp } from "#core/http/app";
+import { createHttpApp } from "#apps/http";
 
 export const app = createHttpApp("api", { title: "__APP_NAME__ API" });

package/templates/features/base/files/src/core/http/context.ts

@@ -3,6 +3,8 @@ import type { Logger } from "#core/logging/logger";
 export interface Principal {
 	userId: string;
 	orgId: string | null;
+	/** the caller's role in orgId, set by requireOrg() */
+	orgRole?: string | null;
 	roles: string[];
 	kind: "user" | "service";
 	claims: Record<string, unknown>;

package/templates/features/better-auth/files/src/{core/auth → modules/users}/db/seed.ts

@@ -1,4 +1,4 @@
-import { auth } from "#core/auth/auth";
+import { auth } from "#modules/users/services/auth";
 import { env } from "#core/config/env";
 import { defineSeed } from "@tatara/db";