@udibo/oauth2 0.13.0 → 0.14.0

package/esm/testing/contract/tenant.d.ts

@@ -73,6 +73,13 @@ export interface TenantContractFixture {
     addMember(organizationId: string, userId: string, permissions: string[]): Promise<void>;
     /** Ends a membership. */
     removeMember(organizationId: string, userId: string): Promise<void>;
+    /**
+     * Defines a tenant-wide role carrying `permissions`, which an
+     * organization's manager may grant a member through
+     * `POST /api/organizations/:organizationId/members/:userId/roles`, and
+     * returns its id.
+     */
+    addRole(permissions: string[]): Promise<string>;
     /**
      * Grants `permissions` on one instance of a resource type to a person, or
      * to every member of an organization. Registers the type if it is new.

package/esm/testing/contract/tenant.js

@@ -663,6 +663,237 @@ export function runTenantContractTests(options) {
                 const reply = await call(null, "GET", "/api/organizations");
                 assertEquals(reply.status, 401);
             });
+            describe("application roles a manager grants a member", () => {
+                const APP_PERMISSION = "contract:app";
+                let roleId;
+                let option;
+                beforeAll(async () => {
+                    roleId = await tenant.addRole([APP_PERMISSION]);
+                    const listed = await call(seats.admin.token, "GET", `/api/organizations/${organization.id}/member-roles`);
+                    assertEquals(listed.status, 200);
+                    const found = listed.body.find((entry) => entry.id === roleId);
+                    assert(found, "member-roles does not list the role by its id");
+                    option = found;
+                });
+                const rolesPath = (userId, organizationId = organization.id) => `/api/organizations/${organizationId}/members/${userId}/roles`;
+                async function seated() {
+                    const seatedPerson = await person();
+                    await seat(seats.owner.token, organization.id, seatedPerson, "member");
+                    return seatedPerson;
+                }
+                async function grantRole(managerToken, userId, id = roleId, organizationId = organization.id) {
+                    return await call(managerToken, "POST", rolesPath(userId, organizationId), { roleId: id });
+                }
+                async function heldBy(userId, managerToken = seats.admin.token, organizationId = organization.id) {
+                    const reply = await call(managerToken, "GET", rolesPath(userId, organizationId));
+                    assertEquals(reply.status, 200, JSON.stringify(reply.body));
+                    return reply.body;
+                }
+                async function holds(accessToken, organizationId) {
+                    const reply = await ask(accessToken, "/api/check", {
+                        permissions: [APP_PERMISSION],
+                        ...organizationId
+                            ? { resource: { type: "organization", id: organizationId } }
+                            : {},
+                    });
+                    assertEquals(reply.status, 200);
+                    return reply.body.results[APP_PERMISSION];
+                }
+                async function offersOf(accessToken) {
+                    const reply = await call(accessToken, "GET", "/api/organizations/offers");
+                    assertEquals(reply.status, 200);
+                    return reply.body.offers.map((offer) => offer.id).sort();
+                }
+                it("names a tenant-wide role in member-roles by the id a grant takes, and no built-in tier by any", async () => {
+                    assertEquals(option.id, roleId);
+                    assert(option.slug, "the role is listed by its slug");
+                    assert(option.name, "the role is listed by its name");
+                    const listed = await call(seats.owner.token, "GET", `/api/organizations/${organization.id}/member-roles`);
+                    for (const slug of ["owner", "admin", "member"]) {
+                        const tier = listed.body.find((entry) => entry.slug === slug);
+                        assert(tier, `the built-in ${slug} tier is listed`);
+                        assertFalse("id" in tier, `the built-in ${slug} tier has an id`);
+                    }
+                });
+                it("grants an accepted member a role that counts inside the organization only", async () => {
+                    const member = await seated();
+                    await seat(seats.rival.token, rival.id, member, "member");
+                    assertFalse(await holds(member.token, organization.id));
+                    const granted = await grantRole(seats.admin.token, member.id);
+                    assertEquals(granted.status, 201, JSON.stringify(granted.body));
+                    assertEquals(granted.body.subjectId, member.id);
+                    assertEquals(granted.body.roleId, roleId);
+                    assertEquals(granted.body.builtInRole, null);
+                    assertEquals(granted.body.scopeType, "organization");
+                    assertEquals(granted.body.scopeId, organization.id);
+                    assertEquals(granted.body.created, true);
+                    assert(await holds(member.token, organization.id));
+                    assertFalse(await holds(member.token), "a role held in an organization answered at tenant scope");
+                    assertFalse(await holds(member.token, rival.id), "a role held in one organization answered for another it belongs to");
+                    assertEquals(await heldBy(member.id), [{
+                            id: roleId,
+                            builtInRole: null,
+                            organizationId: null,
+                            slug: option.slug,
+                            name: option.name,
+                            permissions: [APP_PERMISSION],
+                        }]);
+                    const again = await grantRole(seats.owner.token, member.id);
+                    assertEquals(again.status, 201);
+                    assertEquals(again.body.id, granted.body.id);
+                    assertEquals(again.body.created, false);
+                    assertEquals((await heldBy(member.id)).length, 1);
+                });
+                it("revokes a role, after which the permission stops answering and the role is not found", async () => {
+                    const member = await seated();
+                    assertEquals((await grantRole(seats.admin.token, member.id)).status, 201);
+                    const revoked = await call(seats.admin.token, "DELETE", `${rolesPath(member.id)}/${roleId}`);
+                    assertEquals(revoked.status, 204);
+                    assertFalse(await holds(member.token, organization.id));
+                    assertEquals(await heldBy(member.id), []);
+                    const again = await call(seats.admin.token, "DELETE", `${rolesPath(member.id)}/${roleId}`);
+                    assertEquals(again.status, 404);
+                });
+                it("refuses a plain member and a stranger every verb with the 404 an unknown organization gets, and changes nothing", async () => {
+                    const member = await seated();
+                    assertEquals((await grantRole(seats.admin.token, member.id)).status, 201);
+                    const unknown = crypto.randomUUID();
+                    const verbs = [
+                        ["GET", (id) => rolesPath(member.id, id), undefined],
+                        ["POST", (id) => rolesPath(member.id, id), { roleId }],
+                        [
+                            "DELETE",
+                            (id) => `${rolesPath(member.id, id)}/${roleId}`,
+                            undefined,
+                        ],
+                    ];
+                    for (const [method, path, body] of verbs) {
+                        const onUnknown = await call(seats.owner.token, method, path(unknown), body);
+                        assertEquals(onUnknown.status, 404, `${method} on an unknown id`);
+                        for (const caller of [seats.member, seats.outsider]) {
+                            const refused = await call(caller.token, method, path(organization.id), body);
+                            assertEquals(refused.status, 404, `${method} below the manager tier`);
+                            assertEquals(refused.body.detail, onUnknown.body.detail);
+                        }
+                    }
+                    assert(await holds(member.token, organization.id), "a refused revoke took the role away");
+                });
+                it("answers a pending member, a non-member and an unknown user with one 404, granting nothing", async () => {
+                    const pending = await person();
+                    const offered = await invite(seats.admin.token, organization.id, pending.email, "member");
+                    assert(offered.body.status === "membership", offered.body.status);
+                    const details = new Set();
+                    for (const userId of [
+                        pending.id,
+                        seats.outsider.id,
+                        crypto.randomUUID(),
+                    ]) {
+                        const read = await call(seats.admin.token, "GET", rolesPath(userId));
+                        const granted = await grantRole(seats.admin.token, userId);
+                        assertEquals([read.status, granted.status], [404, 404], userId);
+                        details.add(read.body.detail);
+                        details.add(granted.body.detail);
+                    }
+                    assertEquals(details.size, 1, [...details].join(" | "));
+                    assertEquals((await accept(pending.token, offered.body.membership.id)).status, "accepted");
+                    assertEquals(await heldBy(pending.id), []);
+                    assertFalse(await holds(pending.token, organization.id));
+                });
+                it("refuses a role the tenant does not know with 404, and a grant that names no role with 400", async () => {
+                    const member = await seated();
+                    const unknown = await grantRole(seats.admin.token, member.id, crypto.randomUUID());
+                    assertEquals(unknown.status, 404);
+                    const unnamed = await call(seats.admin.token, "POST", rolesPath(member.id), {});
+                    assertEquals(unnamed.status, 400);
+                    assertEquals(await heldBy(member.id), []);
+                });
+                it("refuses a manager revoking a built-in role they do not hold there, and answers any other name with 404", async () => {
+                    const member = await seated();
+                    const asAdmin = await call(seats.admin.token, "DELETE", `${rolesPath(member.id)}/owner`);
+                    assertEquals(asAdmin.status, 403);
+                    const asOwner = await call(seats.owner.token, "DELETE", `${rolesPath(member.id)}/member`);
+                    assertEquals(asOwner.status, 403, "an owner membership is not a built-in role held there");
+                    const unnamed = await call(seats.owner.token, "DELETE", `${rolesPath(member.id)}/not-a-role`);
+                    assertEquals(unnamed.status, 404);
+                });
+                it("ends the roles and open offers a person's last membership carried, so rejoining restores nothing", async () => {
+                    const address = newEmail();
+                    const invited = await invite(seats.owner.token, organization.id, address, "admin");
+                    assert(invited.body.status === "invitation", invited.body.status);
+                    const invitationId = invited.body.invitation.id;
+                    const leaver = await person({ email: address });
+                    await seat(seats.owner.token, organization.id, leaver, "member");
+                    const ownerOffer = await invite(seats.owner.token, organization.id, address, "owner");
+                    assert(ownerOffer.body.status === "membership", ownerOffer.body.status);
+                    assertEquals((await grantRole(seats.admin.token, leaver.id)).status, 201);
+                    assertEquals(await offersOf(leaver.token), [invitationId, ownerOffer.body.membership.id].sort());
+                    const revoked = await call(seats.admin.token, "DELETE", `/api/organizations/${organization.id}/members/${leaver.id}/member`);
+                    assertEquals(revoked.status, 204);
+                    assertEquals(await offersOf(leaver.token), []);
+                    assertFalse((await invitationIdsOf(seats.owner.token, organization.id))
+                        .includes(invitationId), "an invitation to the leaver's address outlived their membership");
+                    const read = await call(seats.admin.token, "GET", rolesPath(leaver.id));
+                    assertEquals(read.status, 404);
+                    await seat(seats.owner.token, organization.id, leaver, "member");
+                    assertEquals(await heldBy(leaver.id), []);
+                    assertFalse(await holds(leaver.token, organization.id), "rejoining restored a role the last membership carried");
+                });
+                it("keeps a role revoke and a membership's end to the person and organization they name", async () => {
+                    const address = newEmail();
+                    const elsewhere = await invite(seats.rival.token, rival.id, address, "member");
+                    assert(elsewhere.body.status === "invitation", elsewhere.body.status);
+                    const leaver = await person({ email: address });
+                    await seat(seats.owner.token, organization.id, leaver, "member");
+                    const bystander = await seated();
+                    await seat(seats.rival.token, rival.id, bystander, "member");
+                    for (const userId of [leaver.id, bystander.id]) {
+                        assertEquals((await grantRole(seats.admin.token, userId)).status, 201);
+                    }
+                    assertEquals((await grantRole(seats.rival.token, bystander.id, roleId, rival.id))
+                        .status, 201);
+                    const revoked = await call(seats.admin.token, "DELETE", `/api/organizations/${organization.id}/members/${leaver.id}/member`);
+                    assertEquals(revoked.status, 204);
+                    assertEquals((await heldBy(bystander.id)).map((role) => role.id), [roleId], "one person's membership ending took another's role");
+                    assert((await invitationIdsOf(seats.rival.token, rival.id)).includes(elsewhere.body.invitation.id), "a membership ending here withdrew an invitation elsewhere");
+                    for (const status of [204, 404]) {
+                        const taken = await call(seats.admin.token, "DELETE", `${rolesPath(bystander.id)}/${roleId}`);
+                        assertEquals(taken.status, status);
+                    }
+                    assertEquals((await heldBy(bystander.id, seats.rival.token, rival.id)).map((role) => role.id), [roleId], "a revoke here took the role held in another organization");
+                });
+                it("withdraws only the offer named from someone who is not a member", async () => {
+                    const invitee = await person();
+                    const offers = [];
+                    for (const role of ["member", "admin"]) {
+                        const offered = await invite(seats.owner.token, organization.id, invitee.email, role);
+                        assert(offered.body.status === "membership", offered.body.status);
+                        offers.push(offered.body.membership.id);
+                    }
+                    const withdrawn = await call(seats.owner.token, "DELETE", `/api/organizations/${organization.id}/members/${invitee.id}/member`);
+                    assertEquals(withdrawn.status, 204);
+                    assertEquals(await offersOf(invitee.token), [offers[1]]);
+                });
+                it("ends nothing while the person keeps another accepted role there", async () => {
+                    const stayer = await seated();
+                    await seat(seats.owner.token, organization.id, stayer, "admin");
+                    const ownerOffer = await invite(seats.owner.token, organization.id, stayer.email, "owner");
+                    assert(ownerOffer.body.status === "membership", ownerOffer.body.status);
+                    assertEquals((await grantRole(seats.owner.token, stayer.id)).status, 201);
+                    const revoked = await call(seats.owner.token, "DELETE", `/api/organizations/${organization.id}/members/${stayer.id}/member`);
+                    assertEquals(revoked.status, 204);
+                    assertEquals((await heldBy(stayer.id)).map((role) => role.id), [
+                        roleId,
+                    ]);
+                    assert(await holds(stayer.token, organization.id));
+                    assertEquals(await offersOf(stayer.token), [
+                        ownerOffer.body.membership.id,
+                    ]);
+                    const withdrawn = await call(seats.owner.token, "DELETE", `/api/organizations/${organization.id}/members/${stayer.id}/owner`);
+                    assertEquals(withdrawn.status, 204);
+                    assertEquals(await offersOf(stayer.token), []);
+                    assert(await holds(stayer.token, organization.id), "withdrawing a pending offer ended a role");
+                });
+            });
         });
         describe("the account API", () => {
             it("answers a new person's own metadata bucket, empty, and no cache keeps it", async () => {
@@ -778,6 +1009,18 @@ export function runTenantContractTests(options) {
                 assertEquals(fromFirst.map((session) => session.id).sort(), listed.map((session) => session.id).sort());
                 assertEquals(currentOf(fromFirst), [listed[1].id]);
             });
+            it("leaves an earlier sign-in's credential live when another browser signs in", async () => {
+                const id = await tenant.addUser([], { email: newEmail() });
+                const first = await tenant.signIn(id);
+                const second = await tenant.signIn(id);
+                assertEquals((await introspect(first.access_token)).active, true);
+                assertEquals((await introspect(second.access_token)).active, true);
+                const fromFirst = await sessionsOf(first.access_token);
+                const fromSecond = await sessionsOf(second.access_token);
+                assertEquals(fromFirst.length, 2);
+                assertEquals(currentOf(fromFirst).length, 1);
+                assertFalse(currentOf(fromFirst)[0] === currentOf(fromSecond)[0], "two browsers' sign-ins shared one login session");
+            });
             it("keeps a refreshed credential on the session it was issued from", async () => {
                 const id = await tenant.addUser([], { email: newEmail() });
                 const first = await tenant.signIn(id);

package/esm/testing/tenant.d.ts

@@ -110,7 +110,11 @@ export interface FakeTenantMembership {
      * holds a role. An empty list is also read as `["member"]`.
      */
     roles?: string[];
-    /** Permissions held inside this organization only. */
+    /**
+     * Permissions held inside this organization only, apart from any
+     * application role a manager grants the person there. They end with the
+     * membership.
+     */
     permissions?: string[];
 }
 /** Who a resource grant is for. */
@@ -143,12 +147,27 @@ export interface FakeTenantGrant {
      */
     role?: string;
 }
-/** An organization role your tenant defines beside the built-in tiers. */
+/**
+ * A tenant-wide role your tenant defines beside the built-in tiers. A
+ * membership or an invitation may name it by slug, and an organization's
+ * manager may grant it to a member as an application role by id.
+ */
 export interface FakeTenantOrganizationRole {
     /** The role a membership, an invitation or `org_roles` names. */
     slug: string;
     /** How the role is named to people. Defaults to the slug. */
     name?: string;
+    /**
+     * The id `member-roles` lists and `POST …/members/:userId/roles` takes.
+     * Defaults to a new UUID, or to the id the slug already has when it is
+     * defined again.
+     */
+    id?: string;
+    /**
+     * What the role confers inside an organization on a member it is granted
+     * to there, through `POST …/members/:userId/roles`. Defaults to none.
+     */
+    permissions?: string[];
 }
 /** An external account a person can sign in with. */
 export interface FakeTenantLinkedAccount {
@@ -171,9 +190,9 @@ export interface FakeTenantSignIn {
      * `invalid_request` when the person is not a member.
      */
     organizationId?: string;
-    /** The browser `GET /api/account/sessions` reports for this sign-in. */
+    /** The browser `GET /api/account/sessions` reports for a new login session. */
     userAgent?: string;
-    /** The address `GET /api/account/sessions` reports for this sign-in. */
+    /** The address `GET /api/account/sessions` reports for a new login session. */
     ipAddress?: string;
 }
 /** What {@linkcode FakeTenant.issueAccessToken} mints a token for. */
@@ -233,8 +252,9 @@ export interface FakeTenant {
      */
     addMember(organizationId: string, userId: string, membership?: FakeTenantMembership): void;
     /**
-     * Ends a membership and removes the person's pending membership grants.
-     * Email-address invitations remain. From then on introspection and
+     * Ends a membership, with the application roles it held there, and removes
+     * the person's pending membership grants. Email-address invitations remain.
+     * From then on introspection and
      * `/api/check` stop answering for that
      * organization on credentials issued in it, and UserInfo drops its `org_*`
      * claims; a JWT access token or id_token already minted keeps its claims
@@ -242,10 +262,13 @@ export interface FakeTenant {
      */
     removeMember(organizationId: string, userId: string): void;
     /**
-     * Defines an organization role beside the built-in tiers, so invitations
-     * may offer it and `member-roles` lists it. Throws on a built-in slug.
+     * Defines a tenant-wide role beside the built-in tiers, so invitations may
+     * offer it, `member-roles` lists it, and an organization's manager may grant
+     * it to a member. Returns its id. Defining a slug again changes its name
+     * and permissions and keeps its id. Throws on a built-in slug, on an id
+     * another role holds, and on a new id for a slug already defined.
      */
-    defineOrganizationRole(role: FakeTenantOrganizationRole): void;
+    defineOrganizationRole(role: FakeTenantOrganizationRole): string;
     /** Registers a resource type, so `/api/check` accepts it. */
     registerResourceType(type: string): void;
     /**
@@ -262,10 +285,12 @@ export interface FakeTenant {
      * Chooses who the next authorization requests authenticate as, until
      * called again. With nobody chosen, authorize answers `access_denied`.
      *
-     * Each call is a new browser: the first authorization after it starts a
-     * login session, which the account API lists, and later ones reuse it until
-     * that session is ended. When a first-party application signs in again in
-     * that browser, the credentials the session issued before are revoked.
+     * Each authorization request is a sign-in that starts a new login session,
+     * which the account API lists, and sets a cookie naming it on the tenant's
+     * origin. A request that sends that cookie back, as the same browser does,
+     * continues the session instead while it is live and belongs to the person
+     * chosen. When a first-party application signs in again in a session it
+     * continues, the credentials the session issued before are revoked.
      */
     signInAs(userId: string | null, signIn?: FakeTenantSignIn): void;
     /**

package/esm/testing/tenant.js

@@ -52,7 +52,15 @@ const MACHINE_TOKEN_REFUSAL = "A machine credential has no self to answer for.";
 const OWNER = "owner";
 const MANAGER_ROLES = ["owner", "admin"];
 const DEFAULT_ROLES = ["member"];
+const BUILT_IN_APP_ROLES = [
+    "owner",
+    "admin",
+    "support",
+    "member",
+];
+const LOGIN_SESSION_COOKIE = "fake_tenant_session";
 const ORGANIZATION_NOT_FOUND = "Organization not found";
+const MEMBER_NOT_FOUND = "organization member not found";
 class ConfidentialClientCredentialsGrant extends ClientCredentialsGrant {
     isConfidential;
     constructor(options, isConfidential) {
@@ -243,6 +251,17 @@ function page(rows, request) {
         hasMore,
     };
 }
+function cookieValue(request, name) {
+    for (const pair of (request.headers.get("cookie") ?? "").split(";")) {
+        const separator = pair.indexOf("=");
+        if (separator === -1)
+            continue;
+        if (pair.slice(0, separator).trim() === name) {
+            return pair.slice(separator + 1).trim();
+        }
+    }
+    return undefined;
+}
 function noStore(response) {
     response.headers.set("cache-control", "no-store");
     return response;
@@ -274,6 +293,7 @@ export async function createFakeTenant(options) {
     const userMetadata = new Map();
     const organizations = new Map();
     const definedRoles = new Map();
+    const appRoles = [];
     const invitations = new Map();
     const resourceTypes = new Set();
     const grants = [];
@@ -292,10 +312,18 @@ export async function createFakeTenant(options) {
         : [];
     const isMember = (organizationId, userId) => acceptedRoles(organizationId, userId).length > 0;
     const holdsAny = (organizationId, userId, roles) => acceptedRoles(organizationId, userId).some((role) => roles.includes(role));
+    const definedRoleById = (roleId) => [...definedRoles.values()].find((role) => role.id === roleId);
+    const appRolesHeld = (organizationId, userId) => appRoles.filter((assignment) => assignment.organizationId === organizationId &&
+        assignment.userId === userId);
+    const appRolePermissions = (organizationId, userId) => appRolesHeld(organizationId, userId).flatMap((assignment) => definedRoleById(assignment.roleId)?.permissions ?? []);
     const permissionsIn = (userId, organizationId) => new Set([
         ...users.get(userId)?.permissions ?? [],
         ...isMember(organizationId, userId)
-            ? organizations.get(organizationId).permissions.get(userId) ?? []
+            ? [
+                ...organizations.get(organizationId).permissions.get(userId) ??
+                    [],
+                ...appRolePermissions(organizationId, userId),
+            ]
             : [],
     ]);
     const organizationClaims = (userId, organizationId) => {
@@ -532,17 +560,17 @@ export async function createFakeTenant(options) {
             cursor: null,
         });
     };
-    const liveSessionOf = (chosen) => {
+    const continuedSession = (request, userId) => {
+        const secret = cookieValue(request, LOGIN_SESSION_COOKIE);
+        if (!secret)
+            return undefined;
+        return [...loginSessions.values()].find((session) => session.secret === secret && session.userId === userId);
+    };
+    const startSession = (chosen) => {
         const now = new Date();
-        const existing = chosen.sessionId
-            ? loginSessions.get(chosen.sessionId)
-            : undefined;
-        if (existing) {
-            existing.lastActiveAt = now;
-            return existing.id;
-        }
         const session = {
             id: crypto.randomUUID(),
+            secret: crypto.randomUUID(),
             userId: chosen.userId,
             createdAt: now,
             lastActiveAt: now,
@@ -550,13 +578,20 @@ export async function createFakeTenant(options) {
             userAgent: chosen.userAgent ?? null,
         };
         loginSessions.set(session.id, session);
-        chosen.sessionId = session.id;
-        return session.id;
+        return session;
     };
+    const sessionCookie = (session) => [
+        `${LOGIN_SESSION_COOKIE}=${session.secret}`,
+        "Path=/",
+        "HttpOnly",
+        "SameSite=Lax",
+        ...issuer.startsWith("https:") ? ["Secure"] : [],
+    ].join("; ");
     const authorize = async (request) => {
         const chosen = signedIn;
         const requested = new URL(request.url).searchParams.get("organization");
         let issued;
+        let started;
         const response = await server.handleAuthorizeRequest(request, () => {
             const user = chosen ? users.get(chosen.userId) : undefined;
             if (!chosen || !user)
@@ -564,10 +599,15 @@ export async function createFakeTenant(options) {
             const organizationId = requested
                 ? requestedOrganization(requested, user.id)
                 : chosen.organizationId ?? soleOrganizationOf(user.id);
+            const continued = continuedSession(request, user.id);
+            if (continued)
+                continued.lastActiveAt = new Date();
+            else
+                started = startSession(chosen);
             issued = {
                 userId: user.id,
                 organizationId,
-                sessionId: liveSessionOf(chosen),
+                sessionId: (continued ?? started).id,
             };
             return Promise.resolve({ user });
         });
@@ -575,7 +615,15 @@ export async function createFakeTenant(options) {
         const code = location ? new URL(location).searchParams.get("code") : null;
         if (code && issued)
             signInOfCode.set(code, issued);
-        return response;
+        if (!started)
+            return response;
+        const headers = new Headers(response.headers);
+        headers.append("set-cookie", sessionCookie(started));
+        return new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers,
+        });
     };
     const isLive = async (accessToken) => await tokenService.getToken(accessToken) !== undefined;
     const liveCredentials = async (matches) => {
@@ -708,7 +756,11 @@ export async function createFakeTenant(options) {
     });
     const roleVocabulary = () => [
         ...BUILT_IN_ROLES,
-        ...[...definedRoles].map(([slug, name]) => ({ slug, name })),
+        ...[...definedRoles.values()].map(({ id, slug, name }) => ({
+            id,
+            slug,
+            name,
+        })),
     ];
     const roleName = (slug) => roleVocabulary().find((role) => role.slug === slug)?.name ?? slug;
     const newGrant = (organization, userId, role, fields) => {
@@ -781,6 +833,31 @@ export async function createFakeTenant(options) {
         }
     };
     const userByEmail = (email) => [...users.values()].find((user) => user.email?.toLowerCase() === email);
+    const endAppRoles = (organizationId, userId) => {
+        for (const assignment of [...appRoles]) {
+            if (assignment.organizationId === organizationId &&
+                (userId === undefined || assignment.userId === userId)) {
+                appRoles.splice(appRoles.indexOf(assignment), 1);
+            }
+        }
+    };
+    const endMembershipStanding = (organization, userId) => {
+        endAppRoles(organization.id, userId);
+        organization.permissions.delete(userId);
+        organization.grants = organization.grants.filter((grant) => grant.userId !== userId || grant.acceptedAt);
+        const email = users.get(userId)?.email?.toLowerCase();
+        if (!email)
+            return;
+        const now = new Date();
+        for (const invitation of invitations.values()) {
+            if (invitation.organizationId === organization.id &&
+                invitation.email === email && !invitation.acceptedAt &&
+                !invitation.deletedAt) {
+                invitation.deletedAt = now;
+                invitation.updatedAt = now;
+            }
+        }
+    };
     const holdsGrantOnResource = (organizationId) => grants.filter((grant) => grant.subject.type === "organization" &&
         grant.subject.id === organizationId);
     const organizationApi = (handler) => async (request, params) => {
@@ -884,6 +961,7 @@ export async function createFakeTenant(options) {
             return problem(409, `This organization still holds a role on ${named}. Revoke what it holds before deleting it.`);
         }
         organizations.delete(organization.id);
+        endAppRoles(organization.id);
         return new Response(null, { status: 204 });
     });
     const listMembers = organizationApi((caller, request, [id]) => {
@@ -924,6 +1002,82 @@ export async function createFakeTenant(options) {
         if (!grant)
             return problem(404, "Organization membership not found");
         organization.grants.splice(organization.grants.indexOf(grant), 1);
+        if (grant.acceptedAt && !isMember(organization.id, userId)) {
+            endMembershipStanding(organization, userId);
+        }
+        return new Response(null, { status: 204 });
+    });
+    const heldRoleJson = (role) => ({
+        id: role.id,
+        builtInRole: null,
+        organizationId: null,
+        slug: role.slug,
+        name: role.name,
+        permissions: [...role.permissions],
+    });
+    const listMemberAppRoles = organizationApi((caller, _request, [id, userId]) => {
+        const organization = managedOrganization(caller, id);
+        if (organization instanceof Response)
+            return organization;
+        if (!isMember(organization.id, userId)) {
+            return problem(404, MEMBER_NOT_FOUND);
+        }
+        return Response.json(appRolesHeld(organization.id, userId)
+            .flatMap((assignment) => {
+            const role = definedRoleById(assignment.roleId);
+            return role ? [heldRoleJson(role)] : [];
+        })
+            .sort((a, b) => a.name.localeCompare(b.name)));
+    });
+    const grantMemberAppRole = organizationApi(async (caller, request, [id, userId]) => {
+        const organization = managedOrganization(caller, id);
+        if (organization instanceof Response)
+            return organization;
+        const body = await jsonBody(request);
+        if (!isRecord(body) || typeof body.roleId !== "string" ||
+            body.roleId.length === 0) {
+            return invalid("roleId", "A role id is required");
+        }
+        if (!isMember(organization.id, userId)) {
+            return problem(404, MEMBER_NOT_FOUND);
+        }
+        const role = definedRoleById(body.roleId);
+        if (!role)
+            return problem(404, "organization role not found");
+        const held = appRolesHeld(organization.id, userId).find((assignment) => assignment.roleId === role.id);
+        const assignment = held ?? {
+            id: crypto.randomUUID(),
+            organizationId: organization.id,
+            userId,
+            roleId: role.id,
+        };
+        if (!held)
+            appRoles.push(assignment);
+        return Response.json({
+            id: assignment.id,
+            subjectId: userId,
+            subjectRole: null,
+            roleId: role.id,
+            builtInRole: null,
+            scopeType: "organization",
+            scopeId: organization.id,
+            created: !held,
+        }, { status: 201 });
+    });
+    const revokeMemberAppRole = organizationApi((caller, _request, [id, userId, roleId]) => {
+        const organization = managedOrganization(caller, id);
+        if (organization instanceof Response)
+            return organization;
+        if (BUILT_IN_APP_ROLES.includes(roleId)) {
+            const who = roleId === OWNER
+                ? "Only an owner"
+                : "Only an admin or owner";
+            return problem(403, `${who} can grant or revoke ${roleId} access.`);
+        }
+        const held = appRolesHeld(organization.id, userId).find((assignment) => assignment.roleId === roleId);
+        if (!held)
+            return problem(404, "role assignment not found");
+        appRoles.splice(appRoles.indexOf(held), 1);
         return new Response(null, { status: 204 });
     });
     const invite = organizationApi(async (caller, request, [id]) => {
@@ -1310,6 +1464,21 @@ export async function createFakeTenant(options) {
             new RegExp(`^/api/organizations/${segment}/member-roles$`),
             listMemberRoles,
         ],
+        [
+            "GET",
+            new RegExp(`^/api/organizations/${segment}/members/${segment}/roles$`),
+            listMemberAppRoles,
+        ],
+        [
+            "POST",
+            new RegExp(`^/api/organizations/${segment}/members/${segment}/roles$`),
+            grantMemberAppRole,
+        ],
+        [
+            "DELETE",
+            new RegExp(`^/api/organizations/${segment}/members/${segment}/roles/${segment}$`),
+            revokeMemberAppRole,
+        ],
         [
             "DELETE",
             new RegExp(`^/api/organizations/${segment}/members/${segment}/${segment}$`),
@@ -1441,19 +1610,37 @@ export async function createFakeTenant(options) {
                 return;
             organization.grants = organization.grants.filter((grant) => grant.userId !== userId);
             organization.permissions.delete(userId);
+            endAppRoles(organizationId, userId);
         },
-        defineOrganizationRole: ({ slug, name }) => {
+        defineOrganizationRole: ({ slug, name, id, permissions }) => {
             if (BUILT_IN_ROLES.some((role) => role.slug === slug)) {
                 throw new Error(`"${slug}" is a built-in organization role`);
             }
-            definedRoles.set(slug, name ?? slug);
+            const existing = definedRoles.get(slug)?.id;
+            if (id !== undefined && existing !== undefined && id !== existing) {
+                throw new Error(`Role "${slug}" already has the id "${existing}"`);
+            }
+            const roleId = id ?? existing ?? crypto.randomUUID();
+            const holder = definedRoleById(roleId);
+            if (holder && holder.slug !== slug) {
+                throw new Error(`Role id "${roleId}" belongs to "${holder.slug}"`);
+            }
+            definedRoles.set(slug, {
+                id: roleId,
+                slug,
+                name: name ?? slug,
+                permissions: [...permissions ?? []],
+            });
+            return roleId;
         },
         registerResourceType: (type) => {
             resourceTypes.add(type);
         },
         grant: (grant) => {
             const role = grant.role ?? roleSlugOf(grant.permissions);
-            let roleId = isBuiltInRole(role) ? null : resourceRoleIds.get(role);
+            let roleId = isBuiltInRole(role)
+                ? null
+                : definedRoles.get(role)?.id ?? resourceRoleIds.get(role);
             if (roleId === undefined) {
                 roleId = crypto.randomUUID();
                 resourceRoleIds.set(role, roleId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "repository": {
     "type": "git",