@wtfalch/foundry 0.50.1 → 0.51.1

package/dist/migrations/0061_org_signin_in_app_nullable.sql

@@ -0,0 +1,20 @@
+-- @wtfalch/foundry: `signin_in_app` says "absent" again. In-app sign-in is on by default, so NULL
+-- (the field is not declared) means on, false is a declared off, true a declared on. Every stored
+-- false so far was the old column default, never a choice: it becomes NULL. Runs once: a later run
+-- finds the column already nullable and leaves the declared values alone.
+-- Mirrors src/store/schema.ts's `declaredOrgs`.
+
+do $$
+begin
+  if exists (
+    select 1 from information_schema.columns
+    where table_schema = current_schema()
+      and table_name = 'foundry_declared_orgs'
+      and column_name = 'signin_in_app'
+      and is_nullable = 'NO'
+  ) then
+    alter table foundry_declared_orgs alter column signin_in_app drop not null;
+    alter table foundry_declared_orgs alter column signin_in_app drop default;
+    update foundry_declared_orgs set signin_in_app = null where signin_in_app = false;
+  end if;
+end $$;

package/dist/org.d.ts

@@ -725,7 +725,7 @@ export interface ServicesConfig {
 }
 export declare const SFU_SLOT_MAX = 20;
 /**
- * Per-company sign-in placement. `inApp` (default off) moves the people's sign-in from the
+ * Per-company sign-in placement. `inApp` (default on: absent means on, `false` turns it off) moves the people's sign-in from the
  * company's login host onto each app's own address (`/sign-in` on agora.<domain>, boule.<domain>),
  * through the login that serves that path. Read through `plan/sign-in.ts`'s `inAppSignIn`.
  */
@@ -1053,7 +1053,7 @@ export interface DeclaredOrg {
     hosting: HostingConfig;
     /** Absent means `{ own: false }`. Optional so every existing literal and test fixture compiles unchanged, as `calls.versionPin` and `MailConfig.mailApps` do. */
     services?: ServicesConfig;
-    /** Absent means `{ inApp: false }`. Optional so every existing literal and fixture compiles unchanged. */
+    /** Absent means `{ inApp: true }`. Optional so every existing literal and fixture compiles unchanged. */
     signIn?: SignInConfig;
     /** The company's Boule. Absent means no blue/green. */
     boule?: OrgBuiltinApp;

package/dist/plan/platform-providers.js

@@ -4006,7 +4006,7 @@ async function switchOnArchonIdTokenUserinfo(context, deps) {
     // The planner plans nothing without the method; a stale plan does nothing.
     if (!ownerSignIn || !zitadel?.updateOidcAppIdTokenUserinfoAssertion)
         return {};
-    const orgId = ownerSignIn.organisationId;
+    const orgId = recorded[PLATFORM_ARCHON_CLIENT_ORG_SCOPE_KEY] ?? ownerSignIn.organisationId;
     const projectId = recorded[PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY];
     const appId = recorded[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
     if (!orgId || !projectId || !appId) {
@@ -4091,7 +4091,7 @@ async function registerArchonDesktopCallback(context, deps) {
     if (!ownerSignIn || !zitadel?.getOidcAppRedirectUris || !zitadel.updateOidcAppRedirectUris) {
         return {};
     }
-    const orgId = ownerSignIn.organisationId;
+    const orgId = recorded[PLATFORM_ARCHON_CLIENT_ORG_SCOPE_KEY] ?? ownerSignIn.organisationId;
     const projectId = recorded[PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY];
     const appId = recorded[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
     const hostname = recorded[PLATFORM_ARCHON_CLIENT_HOSTNAME_SCOPE_KEY];

package/dist/plan/sign-in.d.ts

@@ -68,7 +68,7 @@ export declare const SIGN_IN_RATE_LIMIT_SCOPE_KEY = "ratelimit_in_app";
 export declare const SIGN_IN_RATE_LIMIT_DESCRIPTION = "foundry: rate limit sign-in paths (in-app)";
 export declare const SIGN_IN_RATE_LIMIT_EXPRESSION = "(starts_with(http.request.uri.path, \"/auth/\")) or (starts_with(http.request.uri.path, \"/sign-in/\") and not starts_with(http.request.uri.path, \"/sign-in/_next/\"))";
 /**
- * True when the company has the switch on and it applies: a company domain whose login host is
+ * True when the company has the switch on (absent counts as on; only `inApp: false` turns it off) and it applies: a company domain whose login host is
  * `auth.<domain>` (`issuer.usesDomain`) and the shared sign-in. A tier 1 company on `oikos.host` keeps
  * today's flow even when the switch is set (the declaration is refused: `org.ts`'s `validateSignIn`).
  */

package/dist/plan/sign-in.js

@@ -72,12 +72,12 @@ export const SIGN_IN_RATE_LIMIT_SCOPE_KEY = 'ratelimit_in_app';
 export const SIGN_IN_RATE_LIMIT_DESCRIPTION = 'foundry: rate limit sign-in paths (in-app)';
 export const SIGN_IN_RATE_LIMIT_EXPRESSION = '(starts_with(http.request.uri.path, "/auth/")) or (starts_with(http.request.uri.path, "/sign-in/") and not starts_with(http.request.uri.path, "/sign-in/_next/"))';
 /**
- * True when the company has the switch on and it applies: a company domain whose login host is
+ * True when the company has the switch on (absent counts as on; only `inApp: false` turns it off) and it applies: a company domain whose login host is
  * `auth.<domain>` (`issuer.usesDomain`) and the shared sign-in. A tier 1 company on `oikos.host` keeps
  * today's flow even when the switch is set (the declaration is refused: `org.ts`'s `validateSignIn`).
  */
 export function inAppSignIn(org) {
-    return org.signIn?.inApp === true && Boolean(org.domain) && org.issuer.usesDomain;
+    return org.signIn?.inApp !== false && Boolean(org.domain) && org.issuer.usesDomain;
 }
 /**
  * True when an app's live env holds `SIGNIN_UPSTREAM` and the desired env does not: it is to be removed.

package/dist/store/postgres.js

@@ -154,8 +154,8 @@ function rowToOrg(row) {
                 },
             }
             : {}),
-        // Omitted while off.
-        ...(row.signInInApp ? { signIn: { inApp: true } } : {}),
+        // NULL is an absent field (on by default); false and true are declared.
+        ...(row.signInInApp === null ? {} : { signIn: { inApp: row.signInInApp } }),
         // Omitted while off.
         ...(row.customersEnabled || row.customersSignUp
             ? { customers: { enabled: row.customersEnabled, signUp: row.customersSignUp } }
@@ -226,7 +226,7 @@ function orgToRow(org) {
         callsVersionPinSynapse: org.calls.versionPin?.synapse ?? null,
         callsVersionPinMas: org.calls.versionPin?.mas ?? null,
         issuerUsesDomain: org.issuer.usesDomain,
-        signInInApp: org.signIn?.inApp ?? false,
+        signInInApp: org.signIn?.inApp ?? null,
         customersEnabled: org.customers?.enabled ?? false,
         customersSignUp: org.customers?.signUp ?? false,
         bouleBlueGreen: org.boule?.blueGreen ?? null,

package/dist/store/schema.d.ts

@@ -362,8 +362,8 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
             columnType: "PgBoolean";
             data: boolean;
             driverParam: boolean;
-            notNull: true;
-            hasDefault: true;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;

package/dist/store/schema.js

@@ -38,8 +38,8 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     // ServicesConfig (org.ts): false and null are the platform's shared services.
     servicesOwn: boolean('services_own').notNull().default(false),
     servicesSfuSlot: integer('services_sfu_slot'),
-    // SignInConfig.inApp (org.ts); migrations/0054.
-    signInInApp: boolean('signin_in_app').notNull().default(false),
+    // SignInConfig.inApp (org.ts); migrations/0054, nullable in 0061: NULL is an absent field (on).
+    signInInApp: boolean('signin_in_app'),
     // CustomersConfig (org.ts); migrations/0057.
     customersEnabled: boolean('customers_enabled').notNull().default(false),
     customersSignUp: boolean('customers_sign_up').notNull().default(false),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.50.1",
+  "version": "0.51.1",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",