@xylex-group/athena 2.12.0 → 2.13.0

package/bin/athena-js.js

@@ -1,76 +1,104 @@
-#!/usr/bin/env node
-
-import { existsSync, readFileSync } from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath, pathToFileURL } from 'node:url'
-
-const binPath = fileURLToPath(import.meta.url)
-const packageRoot = path.resolve(path.dirname(binPath), '..')
-const cliEntrypointPath = path.resolve(packageRoot, 'dist', 'cli', 'index.js')
-const packageJsonPath = path.resolve(packageRoot, 'package.json')
-
-function getInstalledVersion() {
-  try {
-    const packageJsonRaw = readFileSync(packageJsonPath, 'utf8')
-    const packageJson = JSON.parse(packageJsonRaw)
-    return typeof packageJson.version === 'string' ? packageJson.version : 'unknown'
-  } catch {
-    return 'unknown'
-  }
-}
-
-function printMissingEntrypointError() {
-  const installedVersion = getInstalledVersion()
-  console.error(
-    [
-      'Failed to start athena-js CLI: package install is missing the generated CLI entrypoint.',
-      `Expected file: ${cliEntrypointPath}`,
-      `Installed package version: ${installedVersion}`,
-      '',
-      'Fix by reinstalling the latest package:',
-      '  pnpm add -g @xylex-group/athena@latest',
-    ].join('\n'),
-  )
-}
-
-function formatRuntimeError(error) {
-  if (error instanceof Error) {
-    if (process.env.ATHENA_JS_DEBUG === '1') {
-      return error.stack ?? error.message;
-    }
-    return error.message;
-  }
-
-  if (typeof error === 'string') {
-    return error;
-  }
-
-  return 'Unknown error.';
-}
-
-async function main() {
-  if (!existsSync(cliEntrypointPath)) {
-    printMissingEntrypointError();
-    process.exit(1);
-    return;
-  }
-
-  try {
-    const cliEntrypointUrl = pathToFileURL(cliEntrypointPath).href;
-    const cliModule = await import(cliEntrypointUrl);
-    if (typeof cliModule.runCLI !== 'function') {
-      throw new Error('CLI module does not export runCLI.');
-    }
-    await cliModule.runCLI(process.argv.slice(2));
-  } catch (err) {
-    const errorDetail = formatRuntimeError(err);
-    if (errorDetail.includes('\n')) {
-      console.error(`Failed to start athena-js CLI:\n${errorDetail}`);
-    } else {
-      console.error(`Failed to start athena-js CLI: ${errorDetail}`);
-    }
-    process.exit(1);
-  }
-}
-
-void main()
+#!/usr/bin/env node
+
+import { existsSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const binPath = fileURLToPath(import.meta.url)
+const packageRoot = path.resolve(path.dirname(binPath), '..')
+const cliEntrypointPath = path.resolve(packageRoot, 'dist', 'cli', 'index.js')
+const packageJsonPath = path.resolve(packageRoot, 'package.json')
+
+function getInstalledVersion() {
+  try {
+    const packageJsonRaw = readFileSync(packageJsonPath, 'utf8')
+    const packageJson = JSON.parse(packageJsonRaw)
+    return typeof packageJson.version === 'string' ? packageJson.version : 'unknown'
+  } catch {
+    return 'unknown'
+  }
+}
+
+function isDebugEnabled() {
+  return process.env.ATHENA_JS_DEBUG === '1' || process.env.ATHENA_JS_DEBUG === 'true'
+}
+
+function printMissingEntrypointError() {
+  const installedVersion = getInstalledVersion()
+  console.error(
+    [
+      'Failed to start athena-js CLI: package install is missing the generated CLI entrypoint.',
+      `Expected file: ${cliEntrypointPath}`,
+      `Installed package version: ${installedVersion}`,
+      '',
+      'Fix by reinstalling the latest package:',
+      '  pnpm add -g @xylex-group/athena@latest',
+      '  # or in the project:',
+      '  pnpm add @xylex-group/athena@latest',
+    ].join('\n'),
+  )
+}
+
+function formatRuntimeError(error) {
+  if (error instanceof Error) {
+    if (isDebugEnabled()) {
+      return error.stack ?? error.message
+    }
+    return error.message
+  }
+
+  if (typeof error === 'string') {
+    return error
+  }
+
+  return 'Unknown error.'
+}
+
+function isAlreadyFormattedCliError(detail) {
+  if (typeof detail !== 'string') {
+    return false
+  }
+  return (
+    detail.includes('Schema introspection failed') ||
+    detail.includes('does not exist (code 3D000)') ||
+    detail.includes('Unknown option') ||
+    detail.includes('Diagnostics:') ||
+    detail.includes('Generated ') ||
+    detail.startsWith('[athena-js]')
+  )
+}
+
+async function main() {
+  if (!existsSync(cliEntrypointPath)) {
+    printMissingEntrypointError()
+    process.exit(1)
+    return
+  }
+
+  try {
+    const cliEntrypointUrl = pathToFileURL(cliEntrypointPath).href
+    const cliModule = await import(cliEntrypointUrl)
+    if (typeof cliModule.runCLI !== 'function') {
+      throw new Error('CLI module does not export runCLI.')
+    }
+    await cliModule.runCLI(process.argv.slice(2))
+    if (typeof process.exitCode === 'number' && process.exitCode !== 0) {
+      process.exit(process.exitCode)
+    }
+  } catch (err) {
+    const errorDetail = formatRuntimeError(err)
+    if (isAlreadyFormattedCliError(errorDetail)) {
+      console.error(errorDetail)
+    } else if (errorDetail.includes('\n')) {
+      console.error(`Failed to start athena-js CLI:\n${errorDetail}`)
+    } else {
+      console.error(`Failed to start athena-js CLI: ${errorDetail}`)
+    }
+    if (isDebugEnabled() && err instanceof Error && err.stack && !String(errorDetail).includes(err.stack)) {
+      console.error(err.stack)
+    }
+    process.exit(1)
+  }
+}
+
+void main()

package/dist/admin.cjs

@@ -0,0 +1,45 @@
+'use strict';
+
+// src/admin/index.ts
+function hasAdminRole(session) {
+  const role = session?.user?.role;
+  if (!role) {
+    return false;
+  }
+  return role.split(",").map((item) => item.trim().toLowerCase()).includes("admin");
+}
+async function hasAdminPermission(client, input) {
+  if (!input.session?.user?.id) {
+    return false;
+  }
+  if (input.allowRoleBypass !== false && hasAdminRole(input.session)) {
+    return true;
+  }
+  const result = await client.auth.admin.hasPermission(
+    {
+      permission: input.permission,
+      permissions: input.permissions,
+      ...input.fetchOptions ? { fetchOptions: input.fetchOptions } : {}
+    },
+    input.requestOptions
+  );
+  return Boolean(result.ok && result.data?.success);
+}
+async function resolveAdminPermission(client, input) {
+  if (!input.session) {
+    return { ok: false, status: 401, error: "Unauthorized" };
+  }
+  if (!await hasAdminPermission(client, input)) {
+    return { ok: false, status: 403, error: "Forbidden" };
+  }
+  return {
+    ok: true,
+    session: input.session
+  };
+}
+
+exports.hasAdminPermission = hasAdminPermission;
+exports.hasAdminRole = hasAdminRole;
+exports.resolveAdminPermission = resolveAdminPermission;
+//# sourceMappingURL=admin.cjs.map
+//# sourceMappingURL=admin.cjs.map

package/dist/admin.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/admin/index.ts"],"names":[],"mappings":";;;AA4DO,SAAS,aACd,OAAA,EACS;AACT,EAAA,MAAM,IAAA,GAAO,SAAS,IAAA,EAAM,IAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA,CACJ,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAA,IAAA,KAAQ,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAa,CAAA,CACrC,SAAS,OAAO,CAAA;AACrB;AAQA,eAAsB,kBAAA,CACpB,QACA,KAAA,EACkB;AAClB,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,IAAA,EAAM,EAAA,EAAI;AAC5B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAM,eAAA,KAAoB,KAAA,IAAS,YAAA,CAAa,KAAA,CAAM,OAAO,CAAA,EAAG;AAClE,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,aAAA;AAAA,IACrC;AAAA,MACE,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,GAAI,MAAM,YAAA,GAAe,EAAE,cAAc,KAAA,CAAM,YAAA,KAAiB;AAAC,KACnE;AAAA,IACA,KAAA,CAAM;AAAA,GACR;AAEA,EAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,EAAA,IAAM,MAAA,CAAO,MAAM,OAAO,CAAA;AAClD;AAQA,eAAsB,sBAAA,CAGpB,QACA,KAAA,EAGgD;AAChD,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,GAAA,EAAK,OAAO,cAAA,EAAe;AAAA,EACzD;AAEA,EAAA,IAAI,CAAE,MAAM,kBAAA,CAAmB,MAAA,EAAQ,KAAK,CAAA,EAAI;AAC9C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,GAAA,EAAK,OAAO,WAAA,EAAY;AAAA,EACtD;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,SAAS,KAAA,CAAM;AAAA,GACjB;AACF","file":"admin.cjs","sourcesContent":["import type {\n  AthenaAdminHasPermissionRequest,\n  AthenaAuthBindings,\n  AthenaAuthCallOptions,\n  AthenaAuthFetchCompatibleInput,\n} from '../auth/types.ts'\n\n/**\n * Minimal session shape used by the admin convenience helpers.\n *\n * This stays framework-agnostic so callers can pass Athena auth sessions,\n * app-local session wrappers, or request-derived session snapshots.\n */\nexport interface AthenaAdminSessionLike {\n  user?: {\n    id?: string | null | undefined\n    role?: string | null | undefined\n  } | null | undefined\n  session?: {\n    token?: string | null | undefined\n    activeOrganizationId?: string | null | undefined\n  } | null | undefined\n}\n\nexport interface AthenaAdminPermissionClient {\n  auth: Pick<AthenaAuthBindings, 'admin'>\n}\n\nexport interface AthenaAdminPermissionCheckInput {\n  session: AthenaAdminSessionLike | null | undefined\n  permissions: AthenaAdminHasPermissionRequest['permissions']\n  permission?: AthenaAdminHasPermissionRequest['permission']\n  fetchOptions?: AthenaAuthFetchCompatibleInput['fetchOptions']\n  requestOptions?: AthenaAuthCallOptions\n  allowRoleBypass?: boolean\n}\n\nexport interface AthenaAdminPermissionSuccess<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n> {\n  ok: true\n  session: NonNullable<TSession>\n}\n\nexport interface AthenaAdminPermissionFailure {\n  ok: false\n  status: 401 | 403\n  error: 'Unauthorized' | 'Forbidden'\n}\n\nexport type AthenaAdminPermissionResult<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n> = AthenaAdminPermissionSuccess<TSession> | AthenaAdminPermissionFailure\n\n/**\n * Returns true when the session user already carries the `admin` role locally.\n *\n * Role strings are treated as a comma-separated list and normalized\n * case-insensitively so `\"admin\"`, `\"ADMIN\"`, and `\"member, admin\"` all pass.\n */\nexport function hasAdminRole(\n  session: AthenaAdminSessionLike | null | undefined,\n): boolean {\n  const role = session?.user?.role\n  if (!role) {\n    return false\n  }\n\n  return role\n    .split(',')\n    .map(item => item.trim().toLowerCase())\n    .includes('admin')\n}\n\n/**\n * Checks admin permission against the configured Athena auth client.\n *\n * This helper short-circuits when no session user is present and, by default,\n * trusts a local `admin` role before calling `client.auth.admin.hasPermission(...)`.\n */\nexport async function hasAdminPermission(\n  client: AthenaAdminPermissionClient,\n  input: AthenaAdminPermissionCheckInput,\n): Promise<boolean> {\n  if (!input.session?.user?.id) {\n    return false\n  }\n\n  if (input.allowRoleBypass !== false && hasAdminRole(input.session)) {\n    return true\n  }\n\n  const result = await client.auth.admin.hasPermission(\n    {\n      permission: input.permission,\n      permissions: input.permissions,\n      ...(input.fetchOptions ? { fetchOptions: input.fetchOptions } : {}),\n    },\n    input.requestOptions,\n  )\n\n  return Boolean(result.ok && result.data?.success)\n}\n\n/**\n * Resolves an admin permission check into a small framework-agnostic guard result.\n *\n * Consumers can map the returned `{ ok, status, error }` shape into Next.js,\n * Hono, Express, or any other response layer without importing framework types here.\n */\nexport async function resolveAdminPermission<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n>(\n  client: AthenaAdminPermissionClient,\n  input: Omit<AthenaAdminPermissionCheckInput, 'session'> & {\n    session: TSession | null | undefined\n  },\n): Promise<AthenaAdminPermissionResult<TSession>> {\n  if (!input.session) {\n    return { ok: false, status: 401, error: 'Unauthorized' }\n  }\n\n  if (!(await hasAdminPermission(client, input))) {\n    return { ok: false, status: 403, error: 'Forbidden' }\n  }\n\n  return {\n    ok: true,\n    session: input.session as NonNullable<TSession>,\n  }\n}\n"]}

package/dist/admin.d.cts

@@ -0,0 +1,64 @@
+import { aF as AthenaAdminHasPermissionRequest, aG as AthenaAuthFetchCompatibleInput, E as AthenaAuthCallOptions, D as AthenaAuthBindings } from './types-eAKAh71s.cjs';
+
+/**
+ * Minimal session shape used by the admin convenience helpers.
+ *
+ * This stays framework-agnostic so callers can pass Athena auth sessions,
+ * app-local session wrappers, or request-derived session snapshots.
+ */
+interface AthenaAdminSessionLike {
+    user?: {
+        id?: string | null | undefined;
+        role?: string | null | undefined;
+    } | null | undefined;
+    session?: {
+        token?: string | null | undefined;
+        activeOrganizationId?: string | null | undefined;
+    } | null | undefined;
+}
+interface AthenaAdminPermissionClient {
+    auth: Pick<AthenaAuthBindings, 'admin'>;
+}
+interface AthenaAdminPermissionCheckInput {
+    session: AthenaAdminSessionLike | null | undefined;
+    permissions: AthenaAdminHasPermissionRequest['permissions'];
+    permission?: AthenaAdminHasPermissionRequest['permission'];
+    fetchOptions?: AthenaAuthFetchCompatibleInput['fetchOptions'];
+    requestOptions?: AthenaAuthCallOptions;
+    allowRoleBypass?: boolean;
+}
+interface AthenaAdminPermissionSuccess<TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike> {
+    ok: true;
+    session: NonNullable<TSession>;
+}
+interface AthenaAdminPermissionFailure {
+    ok: false;
+    status: 401 | 403;
+    error: 'Unauthorized' | 'Forbidden';
+}
+type AthenaAdminPermissionResult<TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike> = AthenaAdminPermissionSuccess<TSession> | AthenaAdminPermissionFailure;
+/**
+ * Returns true when the session user already carries the `admin` role locally.
+ *
+ * Role strings are treated as a comma-separated list and normalized
+ * case-insensitively so `"admin"`, `"ADMIN"`, and `"member, admin"` all pass.
+ */
+declare function hasAdminRole(session: AthenaAdminSessionLike | null | undefined): boolean;
+/**
+ * Checks admin permission against the configured Athena auth client.
+ *
+ * This helper short-circuits when no session user is present and, by default,
+ * trusts a local `admin` role before calling `client.auth.admin.hasPermission(...)`.
+ */
+declare function hasAdminPermission(client: AthenaAdminPermissionClient, input: AthenaAdminPermissionCheckInput): Promise<boolean>;
+/**
+ * Resolves an admin permission check into a small framework-agnostic guard result.
+ *
+ * Consumers can map the returned `{ ok, status, error }` shape into Next.js,
+ * Hono, Express, or any other response layer without importing framework types here.
+ */
+declare function resolveAdminPermission<TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike>(client: AthenaAdminPermissionClient, input: Omit<AthenaAdminPermissionCheckInput, 'session'> & {
+    session: TSession | null | undefined;
+}): Promise<AthenaAdminPermissionResult<TSession>>;
+
+export { type AthenaAdminPermissionCheckInput, type AthenaAdminPermissionClient, type AthenaAdminPermissionFailure, type AthenaAdminPermissionResult, type AthenaAdminPermissionSuccess, type AthenaAdminSessionLike, hasAdminPermission, hasAdminRole, resolveAdminPermission };

package/dist/admin.d.ts

@@ -0,0 +1,64 @@
+import { aF as AthenaAdminHasPermissionRequest, aG as AthenaAuthFetchCompatibleInput, E as AthenaAuthCallOptions, D as AthenaAuthBindings } from './types-eAKAh71s.js';
+
+/**
+ * Minimal session shape used by the admin convenience helpers.
+ *
+ * This stays framework-agnostic so callers can pass Athena auth sessions,
+ * app-local session wrappers, or request-derived session snapshots.
+ */
+interface AthenaAdminSessionLike {
+    user?: {
+        id?: string | null | undefined;
+        role?: string | null | undefined;
+    } | null | undefined;
+    session?: {
+        token?: string | null | undefined;
+        activeOrganizationId?: string | null | undefined;
+    } | null | undefined;
+}
+interface AthenaAdminPermissionClient {
+    auth: Pick<AthenaAuthBindings, 'admin'>;
+}
+interface AthenaAdminPermissionCheckInput {
+    session: AthenaAdminSessionLike | null | undefined;
+    permissions: AthenaAdminHasPermissionRequest['permissions'];
+    permission?: AthenaAdminHasPermissionRequest['permission'];
+    fetchOptions?: AthenaAuthFetchCompatibleInput['fetchOptions'];
+    requestOptions?: AthenaAuthCallOptions;
+    allowRoleBypass?: boolean;
+}
+interface AthenaAdminPermissionSuccess<TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike> {
+    ok: true;
+    session: NonNullable<TSession>;
+}
+interface AthenaAdminPermissionFailure {
+    ok: false;
+    status: 401 | 403;
+    error: 'Unauthorized' | 'Forbidden';
+}
+type AthenaAdminPermissionResult<TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike> = AthenaAdminPermissionSuccess<TSession> | AthenaAdminPermissionFailure;
+/**
+ * Returns true when the session user already carries the `admin` role locally.
+ *
+ * Role strings are treated as a comma-separated list and normalized
+ * case-insensitively so `"admin"`, `"ADMIN"`, and `"member, admin"` all pass.
+ */
+declare function hasAdminRole(session: AthenaAdminSessionLike | null | undefined): boolean;
+/**
+ * Checks admin permission against the configured Athena auth client.
+ *
+ * This helper short-circuits when no session user is present and, by default,
+ * trusts a local `admin` role before calling `client.auth.admin.hasPermission(...)`.
+ */
+declare function hasAdminPermission(client: AthenaAdminPermissionClient, input: AthenaAdminPermissionCheckInput): Promise<boolean>;
+/**
+ * Resolves an admin permission check into a small framework-agnostic guard result.
+ *
+ * Consumers can map the returned `{ ok, status, error }` shape into Next.js,
+ * Hono, Express, or any other response layer without importing framework types here.
+ */
+declare function resolveAdminPermission<TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike>(client: AthenaAdminPermissionClient, input: Omit<AthenaAdminPermissionCheckInput, 'session'> & {
+    session: TSession | null | undefined;
+}): Promise<AthenaAdminPermissionResult<TSession>>;
+
+export { type AthenaAdminPermissionCheckInput, type AthenaAdminPermissionClient, type AthenaAdminPermissionFailure, type AthenaAdminPermissionResult, type AthenaAdminPermissionSuccess, type AthenaAdminSessionLike, hasAdminPermission, hasAdminRole, resolveAdminPermission };

package/dist/admin.js

@@ -0,0 +1,41 @@
+// src/admin/index.ts
+function hasAdminRole(session) {
+  const role = session?.user?.role;
+  if (!role) {
+    return false;
+  }
+  return role.split(",").map((item) => item.trim().toLowerCase()).includes("admin");
+}
+async function hasAdminPermission(client, input) {
+  if (!input.session?.user?.id) {
+    return false;
+  }
+  if (input.allowRoleBypass !== false && hasAdminRole(input.session)) {
+    return true;
+  }
+  const result = await client.auth.admin.hasPermission(
+    {
+      permission: input.permission,
+      permissions: input.permissions,
+      ...input.fetchOptions ? { fetchOptions: input.fetchOptions } : {}
+    },
+    input.requestOptions
+  );
+  return Boolean(result.ok && result.data?.success);
+}
+async function resolveAdminPermission(client, input) {
+  if (!input.session) {
+    return { ok: false, status: 401, error: "Unauthorized" };
+  }
+  if (!await hasAdminPermission(client, input)) {
+    return { ok: false, status: 403, error: "Forbidden" };
+  }
+  return {
+    ok: true,
+    session: input.session
+  };
+}
+
+export { hasAdminPermission, hasAdminRole, resolveAdminPermission };
+//# sourceMappingURL=admin.js.map
+//# sourceMappingURL=admin.js.map

package/dist/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/admin/index.ts"],"names":[],"mappings":";AA4DO,SAAS,aACd,OAAA,EACS;AACT,EAAA,MAAM,IAAA,GAAO,SAAS,IAAA,EAAM,IAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA,CACJ,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAA,IAAA,KAAQ,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAa,CAAA,CACrC,SAAS,OAAO,CAAA;AACrB;AAQA,eAAsB,kBAAA,CACpB,QACA,KAAA,EACkB;AAClB,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,IAAA,EAAM,EAAA,EAAI;AAC5B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAM,eAAA,KAAoB,KAAA,IAAS,YAAA,CAAa,KAAA,CAAM,OAAO,CAAA,EAAG;AAClE,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,aAAA;AAAA,IACrC;AAAA,MACE,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,GAAI,MAAM,YAAA,GAAe,EAAE,cAAc,KAAA,CAAM,YAAA,KAAiB;AAAC,KACnE;AAAA,IACA,KAAA,CAAM;AAAA,GACR;AAEA,EAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,EAAA,IAAM,MAAA,CAAO,MAAM,OAAO,CAAA;AAClD;AAQA,eAAsB,sBAAA,CAGpB,QACA,KAAA,EAGgD;AAChD,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,GAAA,EAAK,OAAO,cAAA,EAAe;AAAA,EACzD;AAEA,EAAA,IAAI,CAAE,MAAM,kBAAA,CAAmB,MAAA,EAAQ,KAAK,CAAA,EAAI;AAC9C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,GAAA,EAAK,OAAO,WAAA,EAAY;AAAA,EACtD;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,SAAS,KAAA,CAAM;AAAA,GACjB;AACF","file":"admin.js","sourcesContent":["import type {\n  AthenaAdminHasPermissionRequest,\n  AthenaAuthBindings,\n  AthenaAuthCallOptions,\n  AthenaAuthFetchCompatibleInput,\n} from '../auth/types.ts'\n\n/**\n * Minimal session shape used by the admin convenience helpers.\n *\n * This stays framework-agnostic so callers can pass Athena auth sessions,\n * app-local session wrappers, or request-derived session snapshots.\n */\nexport interface AthenaAdminSessionLike {\n  user?: {\n    id?: string | null | undefined\n    role?: string | null | undefined\n  } | null | undefined\n  session?: {\n    token?: string | null | undefined\n    activeOrganizationId?: string | null | undefined\n  } | null | undefined\n}\n\nexport interface AthenaAdminPermissionClient {\n  auth: Pick<AthenaAuthBindings, 'admin'>\n}\n\nexport interface AthenaAdminPermissionCheckInput {\n  session: AthenaAdminSessionLike | null | undefined\n  permissions: AthenaAdminHasPermissionRequest['permissions']\n  permission?: AthenaAdminHasPermissionRequest['permission']\n  fetchOptions?: AthenaAuthFetchCompatibleInput['fetchOptions']\n  requestOptions?: AthenaAuthCallOptions\n  allowRoleBypass?: boolean\n}\n\nexport interface AthenaAdminPermissionSuccess<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n> {\n  ok: true\n  session: NonNullable<TSession>\n}\n\nexport interface AthenaAdminPermissionFailure {\n  ok: false\n  status: 401 | 403\n  error: 'Unauthorized' | 'Forbidden'\n}\n\nexport type AthenaAdminPermissionResult<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n> = AthenaAdminPermissionSuccess<TSession> | AthenaAdminPermissionFailure\n\n/**\n * Returns true when the session user already carries the `admin` role locally.\n *\n * Role strings are treated as a comma-separated list and normalized\n * case-insensitively so `\"admin\"`, `\"ADMIN\"`, and `\"member, admin\"` all pass.\n */\nexport function hasAdminRole(\n  session: AthenaAdminSessionLike | null | undefined,\n): boolean {\n  const role = session?.user?.role\n  if (!role) {\n    return false\n  }\n\n  return role\n    .split(',')\n    .map(item => item.trim().toLowerCase())\n    .includes('admin')\n}\n\n/**\n * Checks admin permission against the configured Athena auth client.\n *\n * This helper short-circuits when no session user is present and, by default,\n * trusts a local `admin` role before calling `client.auth.admin.hasPermission(...)`.\n */\nexport async function hasAdminPermission(\n  client: AthenaAdminPermissionClient,\n  input: AthenaAdminPermissionCheckInput,\n): Promise<boolean> {\n  if (!input.session?.user?.id) {\n    return false\n  }\n\n  if (input.allowRoleBypass !== false && hasAdminRole(input.session)) {\n    return true\n  }\n\n  const result = await client.auth.admin.hasPermission(\n    {\n      permission: input.permission,\n      permissions: input.permissions,\n      ...(input.fetchOptions ? { fetchOptions: input.fetchOptions } : {}),\n    },\n    input.requestOptions,\n  )\n\n  return Boolean(result.ok && result.data?.success)\n}\n\n/**\n * Resolves an admin permission check into a small framework-agnostic guard result.\n *\n * Consumers can map the returned `{ ok, status, error }` shape into Next.js,\n * Hono, Express, or any other response layer without importing framework types here.\n */\nexport async function resolveAdminPermission<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n>(\n  client: AthenaAdminPermissionClient,\n  input: Omit<AthenaAdminPermissionCheckInput, 'session'> & {\n    session: TSession | null | undefined\n  },\n): Promise<AthenaAdminPermissionResult<TSession>> {\n  if (!input.session) {\n    return { ok: false, status: 401, error: 'Unauthorized' }\n  }\n\n  if (!(await hasAdminPermission(client, input))) {\n    return { ok: false, status: 403, error: 'Forbidden' }\n  }\n\n  return {\n    ok: true,\n    session: input.session as NonNullable<TSession>,\n  }\n}\n"]}