better-auth-organization-member 1.0.0

package/dist/server.js

@@ -0,0 +1,649 @@
+/** @format */
+import { BASE_ERROR_CODES, defineErrorCodes, } from "better-auth";
+import { createAuthEndpoint, createAuthMiddleware, sessionMiddleware, } from "better-auth/api";
+import { clientSideHasPermission } from "better-auth/client/plugins";
+import { toZodSchema } from "better-auth/db";
+import { getOrgAdapter, } from "better-auth/plugins";
+import { APIError } from "better-call";
+import z from "zod";
+const ORGANIZATION_ERROR_CODES = defineErrorCodes({
+    NO_ACTIVE_ORGANIZATION: "No active organization",
+    MEMBER_NOT_FOUND: "Member not found",
+    ORGANIZATION_NOT_FOUND: "Organization not found",
+    YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_MEMBER: "You are not allowed to update this member",
+    YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER: "You cannot leave the organization without an owner",
+    INVITATION_NOT_FOUND: "Invitation not found",
+    YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_INVITATION: "You are not allowed to update this invitation",
+    ONLY_PENDING_INVITATIONS_CAN_BE_UPDATED: "Only pending invitations can be updated",
+    YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION: "You are not a member of this organization",
+});
+const getOrganizationPlugin = (ctx) => {
+    return ctx.options.plugins?.find((plugin) => plugin.id === "organization");
+};
+export const orgMiddleware = createAuthMiddleware(async () => {
+    return {};
+});
+/**
+ * The middleware forces the endpoint to require a valid session by utilizing the `sessionMiddleware`.
+ * It also appends additional types to the session type regarding organizations.
+ */
+export const orgSessionMiddleware = createAuthMiddleware({
+    use: [sessionMiddleware],
+}, async (ctx) => {
+    const session = ctx.context.session;
+    return {
+        session,
+    };
+});
+/**
+ * Organization Member Plugin
+ *
+ * Extends the organization plugin with:
+ * - updateMember endpoint to update member fields (not just role)
+ * - Automatically adds afterAcceptInvitation hook to transfer invitation data to member
+ *
+ * @requires organization plugin
+ */
+const createUpdateMemberEndpoint = (options) => {
+    // from /better-auth/packages/better-auth/src/plugins/organization/routes/crud-members.ts
+    const baseMemberSchema = z.object({
+        role: z.union([z.string(), z.array(z.string())]).meta({
+            description: 'The new role to be applied. This can be a string or array of strings representing the roles. Eg: ["admin", "sale"]',
+        }),
+        memberId: z.string().meta({
+            description: 'The member id to apply the role update to. Eg: "member-id"',
+        }),
+        organizationId: z
+            .string()
+            .meta({
+            description: 'An optional organization ID which the member is a part of to apply the role update. If not provided, you must provide session headers to get the active organization. Eg: "organization-id"',
+        })
+            .optional(),
+        // Manually add default member fields
+        firstName: z.string().optional().meta({
+            description: "First name of the member",
+        }),
+        lastName: z.string().optional().meta({
+            description: "Last name of the member",
+        }),
+        avatar: z.string().optional().meta({
+            description: "Avatar URL of the member",
+        }),
+        status: z.enum(["active", "inactive"]).optional(),
+    });
+    const additionalFieldsSchema = toZodSchema({
+        fields: options?.schema?.member?.additionalFields || {},
+        isClientSide: true,
+    });
+    // Remove status field from additionalFieldsSchema to prevent overriding the strict enum in baseMemberSchema
+    const { status: _status, ...additionalFieldsWithoutStatus } = additionalFieldsSchema.shape;
+    return createAuthEndpoint("/organization/update-member", {
+        method: "POST",
+        body: z.object({
+            ...baseMemberSchema.shape,
+            ...additionalFieldsWithoutStatus.shape,
+        }),
+        use: [orgMiddleware, orgSessionMiddleware],
+        requireHeaders: true,
+        metadata: {
+            $Infer: {
+                body: {},
+            },
+            openapi: {
+                operationId: "updateOrganizationMember",
+                description: "Update a member in an organization",
+                responses: {
+                    "200": {
+                        description: "Success",
+                        content: {
+                            "application/json": {
+                                schema: {
+                                    type: "object",
+                                    properties: {
+                                        id: {
+                                            type: "string",
+                                        },
+                                        userId: {
+                                            type: "string",
+                                        },
+                                        organizationId: {
+                                            type: "string",
+                                        },
+                                        firstName: {
+                                            type: "string",
+                                        },
+                                        lastName: {
+                                            type: "string",
+                                        },
+                                        avatar: {
+                                            type: "string",
+                                        },
+                                        status: {
+                                            type: "string",
+                                        },
+                                    },
+                                    required: ["id", "userId", "organizationId", "role"],
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        },
+    }, async (ctx) => {
+        const session = ctx.context.session;
+        const organizationPlugin = getOrganizationPlugin(ctx.context);
+        if (!organizationPlugin) {
+            throw new Error("organization-member plugin requires the organization plugin");
+        }
+        if (!ctx.body.role) {
+            throw new APIError("BAD_REQUEST");
+        }
+        const organizationId = ctx.body.organizationId || session.session.activeOrganizationId;
+        if (!organizationId) {
+            throw new APIError("BAD_REQUEST", {
+                message: ORGANIZATION_ERROR_CODES.NO_ACTIVE_ORGANIZATION,
+            });
+        }
+        const adapter = getOrgAdapter(ctx.context, organizationPlugin.options);
+        const roleToSet = Array.isArray(ctx.body.role)
+            ? ctx.body.role
+            : ctx.body.role
+                ? [ctx.body.role]
+                : [];
+        const member = await adapter.findMemberByOrgId({
+            userId: session.user.id,
+            organizationId: organizationId,
+        });
+        if (!member) {
+            throw new APIError("BAD_REQUEST", {
+                message: ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND,
+            });
+        }
+        const toBeUpdatedMember = member.id !== ctx.body.memberId
+            ? await adapter.findMemberById(ctx.body.memberId)
+            : member;
+        if (!toBeUpdatedMember) {
+            throw new APIError("BAD_REQUEST", {
+                message: ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND,
+            });
+        }
+        const memberBelongsToOrganization = toBeUpdatedMember.organizationId === organizationId;
+        if (!memberBelongsToOrganization) {
+            throw new APIError("FORBIDDEN", {
+                message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_MEMBER,
+            });
+        }
+        const creatorRole = organizationPlugin.options?.creatorRole || "owner";
+        const updatingMemberRoles = member.role.split(",");
+        const toBeUpdatedMemberRoles = toBeUpdatedMember.role.split(",");
+        const isUpdatingCreator = toBeUpdatedMemberRoles.includes(creatorRole);
+        const updaterIsCreator = updatingMemberRoles.includes(creatorRole);
+        const isSettingCreatorRole = roleToSet.includes(creatorRole);
+        const memberIsUpdatingThemselves = member.id === toBeUpdatedMember.id;
+        if ((isUpdatingCreator && !updaterIsCreator) ||
+            (isSettingCreatorRole && !updaterIsCreator)) {
+            throw new APIError("FORBIDDEN", {
+                message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_MEMBER,
+            });
+        }
+        if (updaterIsCreator && memberIsUpdatingThemselves) {
+            const members = await ctx.context.adapter.findMany({
+                model: "member",
+                where: [
+                    {
+                        field: "organizationId",
+                        value: organizationId,
+                    },
+                ],
+            });
+            const owners = members.filter((member) => {
+                const roles = member.role.split(",");
+                return roles.includes(creatorRole);
+            });
+            if (owners.length <= 1 && !isSettingCreatorRole) {
+                throw new APIError("BAD_REQUEST", {
+                    message: ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER,
+                });
+            }
+        }
+        // currently use clientSideHasPermission instead of hasPermission
+        // this does not support dynamic access control yet
+        // TODO: improve me
+        const canUpdateMember = clientSideHasPermission({
+            role: member.role,
+            options: organizationPlugin.options,
+            permissions: {
+                member: ["update"],
+            },
+            allowCreatorAllPermissions: true,
+        });
+        if (!canUpdateMember) {
+            throw new APIError("FORBIDDEN", {
+                message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_MEMBER,
+            });
+        }
+        // Get organization
+        const organization = await adapter.findOrganizationById(organizationId);
+        if (!organization) {
+            throw new APIError("BAD_REQUEST", {
+                message: ORGANIZATION_ERROR_CODES.ORGANIZATION_NOT_FOUND,
+            });
+        }
+        const userBeingUpdated = await ctx.context.internalAdapter.findUserById(toBeUpdatedMember.userId);
+        if (!userBeingUpdated) {
+            throw new APIError("BAD_REQUEST", {
+                message: BASE_ERROR_CODES.USER_NOT_FOUND,
+            });
+        }
+        // Extract updates (exclude memberId and organizationId from body)
+        const { memberId: _, organizationId: __, ...updates } = ctx.body;
+        let finalUpdates = updates;
+        // Run beforeUpdateMember hook (if provided via options parameter)
+        if (options?.organizationMemberHooks?.beforeUpdateMember) {
+            const response = await options.organizationMemberHooks.beforeUpdateMember({
+                member: toBeUpdatedMember,
+                updates,
+                user: userBeingUpdated,
+                organization: organization,
+            });
+            if (response && typeof response === "object" && "data" in response) {
+                finalUpdates = response.data;
+            }
+        }
+        // Update the member - NOTE: this is different from updateMemberRole
+        // which only updates the role field. We update any additional fields.
+        const updatedMember = await ctx.context.adapter.update({
+            model: "member",
+            where: [{ field: "id", value: ctx.body.memberId }],
+            update: finalUpdates,
+        });
+        if (!updatedMember) {
+            throw new APIError("BAD_REQUEST", {
+                message: ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND,
+            });
+        }
+        // Run afterUpdateMember hook (if provided via options parameter)
+        if (options?.organizationMemberHooks?.afterUpdateMember) {
+            await options.organizationMemberHooks.afterUpdateMember({
+                member: updatedMember,
+                user: userBeingUpdated,
+                organization: organization,
+            });
+        }
+        return ctx.json(updatedMember);
+    });
+};
+const createGetMemberEndpoint = () => {
+    return createAuthEndpoint("/organization/get-member", {
+        method: "GET",
+        query: z.object({
+            userId: z.string().meta({
+                description: 'The user id of the member to retrieve. Eg: "user-id"',
+            }).optional(),
+            organizationId: z
+                .string()
+                .meta({
+                description: 'The organization ID which the member belongs to. If not provided, will default to the user\'s active organization. Eg: "organization-id"',
+            })
+                .optional(),
+            organizationSlug: z
+                .string()
+                .meta({
+                description: 'The organization slug to get member for. If not provided, will default to the user\'s active organization. Eg: "organization-slug"',
+            })
+                .optional(),
+        }),
+        use: [orgMiddleware, orgSessionMiddleware],
+        requireHeaders: true,
+        metadata: {
+            $Infer: {
+                query: {},
+            },
+            openapi: {
+                operationId: "getOrganizationMember",
+                description: "Get a member from an organization by user ID",
+                responses: {
+                    "200": {
+                        description: "Success",
+                        content: {
+                            "application/json": {
+                                schema: {
+                                    type: "object",
+                                    properties: {
+                                        id: {
+                                            type: "string",
+                                        },
+                                        userId: {
+                                            type: "string",
+                                        },
+                                        organizationId: {
+                                            type: "string",
+                                        },
+                                        role: {
+                                            type: "string",
+                                        },
+                                        firstName: {
+                                            type: "string",
+                                        },
+                                        lastName: {
+                                            type: "string",
+                                        },
+                                        avatar: {
+                                            type: "string",
+                                        },
+                                        status: {
+                                            type: "string",
+                                        },
+                                        createdAt: {
+                                            type: "string",
+                                            format: "date-time",
+                                        },
+                                    },
+                                    required: ["id", "userId", "organizationId", "role"],
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        },
+    }, async (ctx) => {
+        const session = ctx.context.session;
+        const organizationPlugin = getOrganizationPlugin(ctx.context);
+        if (!organizationPlugin) {
+            throw new Error("organization-member plugin requires the organization plugin");
+        }
+        const adapter = getOrgAdapter(ctx.context, organizationPlugin.options);
+        // Resolve organizationId from slug if provided
+        let organizationId = ctx.query?.organizationId || session.session.activeOrganizationId;
+        const userId = ctx.query.userId || session.user.id;
+        if (!userId) {
+            throw new APIError("BAD_REQUEST", {
+                message: BASE_ERROR_CODES.USER_NOT_FOUND,
+            });
+        }
+        if (ctx.query?.organizationSlug) {
+            const organization = await adapter.findOrganizationBySlug(ctx.query.organizationSlug);
+            if (!organization) {
+                throw new APIError("BAD_REQUEST", {
+                    message: ORGANIZATION_ERROR_CODES.ORGANIZATION_NOT_FOUND,
+                });
+            }
+            organizationId = organization.id;
+        }
+        if (!organizationId) {
+            throw new APIError("BAD_REQUEST", {
+                message: ORGANIZATION_ERROR_CODES.NO_ACTIVE_ORGANIZATION,
+            });
+        }
+        // Verify the current user is a member of the organization
+        const currentUserMember = await adapter.findMemberByOrgId({
+            userId: session.user.id,
+            organizationId: organizationId,
+        });
+        if (!currentUserMember) {
+            throw new APIError("FORBIDDEN", {
+                message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION,
+            });
+        }
+        // Return current user member if the query is empty
+        if (!ctx.query.userId && (ctx.query.organizationSlug || ctx.query.organizationId)) {
+            return ctx.json(currentUserMember);
+        }
+        // Get the requested member by userId and organizationId
+        const requestedMember = await adapter.findMemberByOrgId({
+            userId: userId,
+            organizationId: organizationId,
+        });
+        if (!requestedMember) {
+            throw new APIError("BAD_REQUEST", {
+                message: ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND,
+            });
+        }
+        return ctx.json(requestedMember);
+    });
+};
+const createUpdateInvitationEndpoint = (options) => {
+    const baseInvitationSchema = z.object({
+        invitationId: z.string().meta({
+            description: 'The invitation id to update. Eg: "invitation-id"',
+        }),
+        organizationId: z
+            .string()
+            .meta({
+            description: 'An optional organization ID which the invitation belongs to. If not provided, you must provide session headers to get the active organization. Eg: "organization-id"',
+        })
+            .optional(),
+    });
+    const additionalFieldsSchema = toZodSchema({
+        fields: options?.schema?.invitation?.additionalFields || {},
+        isClientSide: true,
+    });
+    return createAuthEndpoint("/organization/update-invitation", {
+        method: "POST",
+        body: z.object({
+            ...baseInvitationSchema.shape,
+            ...additionalFieldsSchema.shape,
+            role: z
+                .union([z.string(), z.array(z.string())])
+                .optional()
+                .meta({
+                description: 'The new role to be applied. This can be a string or array of strings representing the roles. Eg: ["admin", "sale"]',
+            }),
+        }),
+        use: [orgMiddleware, orgSessionMiddleware],
+        requireHeaders: true,
+        metadata: {
+            $Infer: {
+                body: {},
+            },
+            openapi: {
+                operationId: "updateOrganizationInvitation",
+                description: "Update a pending invitation in an organization",
+                responses: {
+                    "200": {
+                        description: "Success",
+                        content: {
+                            "application/json": {
+                                schema: {
+                                    type: "object",
+                                    properties: {
+                                        id: {
+                                            type: "string",
+                                        },
+                                        organizationId: {
+                                            type: "string",
+                                        },
+                                        email: {
+                                            type: "string",
+                                        },
+                                        role: {
+                                            type: "string",
+                                        },
+                                        status: {
+                                            type: "string",
+                                        },
+                                        createdAt: {
+                                            type: "string",
+                                            format: "date-time",
+                                            description: "Timestamp when the team was created",
+                                        },
+                                        updatedAt: {
+                                            type: "string",
+                                            format: "date-time",
+                                            description: "Timestamp when the team was last updated",
+                                        },
+                                    },
+                                    required: [
+                                        "id",
+                                        "organizationId",
+                                        "email",
+                                        "role",
+                                        "status",
+                                    ],
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        },
+    }, async (ctx) => {
+        const session = ctx.context.session;
+        const organizationPlugin = getOrganizationPlugin(ctx.context);
+        if (!organizationPlugin) {
+            throw new Error("organization-member plugin requires the organization plugin");
+        }
+        const organizationId = ctx.body.organizationId || session.session.activeOrganizationId;
+        if (!organizationId) {
+            throw new APIError("BAD_REQUEST", {
+                message: ORGANIZATION_ERROR_CODES.NO_ACTIVE_ORGANIZATION,
+            });
+        }
+        const adapter = getOrgAdapter(ctx.context, organizationPlugin.options);
+        // Get the current user's member record
+        const member = await adapter.findMemberByOrgId({
+            userId: session.user.id,
+            organizationId: organizationId,
+        });
+        if (!member) {
+            throw new APIError("BAD_REQUEST", {
+                message: ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND,
+            });
+        }
+        // Check permissions - user must have permission to manage invitations
+        const canManageInvitations = clientSideHasPermission({
+            role: member.role,
+            options: organizationPlugin.options,
+            permissions: {
+                invitation: ["create"],
+            },
+            allowCreatorAllPermissions: true,
+        });
+        if (!canManageInvitations) {
+            throw new APIError("FORBIDDEN", {
+                message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_INVITATION,
+            });
+        }
+        // Get the invitation
+        const invitation = await adapter.findInvitationById(ctx.body.invitationId);
+        if (!invitation) {
+            throw new APIError("BAD_REQUEST", {
+                message: ORGANIZATION_ERROR_CODES.INVITATION_NOT_FOUND,
+            });
+        }
+        // Verify invitation belongs to the organization
+        if (invitation.organizationId !== organizationId) {
+            throw new APIError("FORBIDDEN", {
+                message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_INVITATION,
+            });
+        }
+        // Only allow updating pending invitations
+        if (invitation.status !== "pending") {
+            throw new APIError("BAD_REQUEST", {
+                message: ORGANIZATION_ERROR_CODES.ONLY_PENDING_INVITATIONS_CAN_BE_UPDATED,
+            });
+        }
+        // Get organization
+        const organization = await adapter.findOrganizationById(organizationId);
+        if (!organization) {
+            throw new APIError("BAD_REQUEST", {
+                message: ORGANIZATION_ERROR_CODES.ORGANIZATION_NOT_FOUND,
+            });
+        }
+        // Extract updates (exclude invitationId and organizationId from body)
+        const { invitationId: _, organizationId: __, ...updates } = ctx.body;
+        let finalUpdates = updates;
+        // Run beforeUpdateInvitation hook (if provided via options parameter)
+        if (options?.organizationMemberHooks?.beforeUpdateInvitation) {
+            const response = await options.organizationMemberHooks.beforeUpdateInvitation({
+                invitation,
+                updates,
+                inviter: session.user,
+                organization,
+            });
+            if (response && typeof response === "object" && "data" in response) {
+                finalUpdates = response.data;
+            }
+        }
+        // Update the invitation
+        const updatedInvitation = await ctx.context.adapter.update({
+            model: "invitation",
+            where: [{ field: "id", value: ctx.body.invitationId }],
+            update: finalUpdates,
+        });
+        if (!updatedInvitation) {
+            throw new APIError("BAD_REQUEST", {
+                message: ORGANIZATION_ERROR_CODES.INVITATION_NOT_FOUND,
+            });
+        }
+        // Run afterUpdateInvitation hook (if provided via options parameter)
+        if (options?.organizationMemberHooks?.afterUpdateInvitation) {
+            await options.organizationMemberHooks.afterUpdateInvitation({
+                invitation: updatedInvitation,
+                inviter: session.user,
+                organization,
+            });
+        }
+        return ctx.json(updatedInvitation);
+    });
+};
+export const organizationMember = (userConfig) => {
+    const config = {
+        ...userConfig,
+    };
+    return {
+        id: "organization-member",
+        init(ctx) {
+            const organizationPlugin = getOrganizationPlugin(ctx);
+            if (!organizationPlugin) {
+                throw new Error("organization-member plugin requires the organization plugin");
+            }
+            // Get or create organizationHooks
+            if (!organizationPlugin.options.organizationHooks) {
+                organizationPlugin.options.organizationHooks = {};
+            }
+            const existingAfterAcceptInvitation = organizationPlugin.options.organizationHooks?.afterAcceptInvitation;
+            organizationPlugin.options.organizationHooks.afterAcceptInvitation =
+                async (data) => {
+                    await existingAfterAcceptInvitation?.(data);
+                    try {
+                        const { invitation, member } = data;
+                        const updateData = {};
+                        // TODO improve me
+                        for (const field of Object.keys(organizationPlugin.options?.schema?.invitation
+                            ?.additionalFields ?? {})) {
+                            const fieldName = organizationPlugin.options?.schema?.invitation
+                                ?.additionalFields?.[field]?.fieldName || field;
+                            updateData[fieldName] = invitation[fieldName];
+                        }
+                        // Only update if there are fields to transfer
+                        if (Object.keys(updateData).length > 0) {
+                            await ctx.adapter.update({
+                                model: "member",
+                                where: [{ field: "id", value: member.id }],
+                                update: updateData,
+                            });
+                            ctx.logger?.info("Member fields updated from invitation:", {
+                                memberId: member.id,
+                                fields: Object.keys(updateData),
+                            });
+                        }
+                    }
+                    catch (error) {
+                        ctx.logger?.error("Failed to update member fields from invitation:", error);
+                        // Don't throw - let the invitation acceptance succeed
+                    }
+                };
+        },
+        endpoints: {
+            getMember: createGetMemberEndpoint(),
+            updateMember: createUpdateMemberEndpoint(userConfig),
+            updateInvitation: createUpdateInvitationEndpoint(userConfig),
+        },
+        options: userConfig,
+        $ERROR_CODES: ORGANIZATION_ERROR_CODES,
+    };
+};
+//# sourceMappingURL=server.js.map