cauthy-auth 0.28.0 → 0.30.0

package/dist/react.mjs

@@ -283,6 +283,12 @@ function checkOrganization(value, required = false) {
   if (v.length > MAX_ORGANIZATION) return { field: "organization", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
   return null;
 }
+function checkOrganizationName(value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return { field: "name", code: "required", message: "Enter the organization's name." };
+  if (v.length > MAX_ORGANIZATION) return { field: "name", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
+  return null;
+}
 function checkCode(value) {
   const v = typeof value === "string" ? value.trim() : "";
   if (v === "") return { field: "code", code: "required", message: "Enter the code." };
@@ -535,7 +541,23 @@ function createAuthClient(options = {}) {
       add: (id, f) => post("/me/organizations/members/add", { organizationId: id, email: f.email, role: f.role, name: f.name ?? "", locale: f.locale ?? "" }, checkEmail(f.email)),
       setRole: (id, userId, role) => post("/me/organizations/members/role", { organizationId: id, userId, role }, null),
       remove: (id, userId) => post("/me/organizations/members/remove", { organizationId: id, userId }, null),
-      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null)
+      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null),
+      rename: (id, name) => post("/me/organizations/rename", { organizationId: id, name }, checkOrganizationName(name)),
+      archive: (id) => post("/me/organizations/archive", { organizationId: id }, null),
+      delete: (id) => post("/me/organizations/delete", { organizationId: id }, null),
+      async check(q) {
+        const organizationId = typeof q.organization === "string" ? q.organization : q.organization?.id ?? "";
+        const r = await post("/me/organizations/check", {
+          organizationId,
+          resource: q.resource,
+          action: q.action,
+          ...q.attributes !== void 0 ? { attributes: q.attributes } : {},
+          ...q.resourceId !== void 0 ? { resourceId: q.resourceId } : {},
+          ...q.ownerId !== void 0 ? { ownerId: q.ownerId } : {}
+        }, null);
+        if (!r.ok) return { allowed: false, reason: r.error.message, error: r.error };
+        return { allowed: r.allowed === true, reason: String(r.reason ?? ""), ...r.rule ? { rule: r.rule } : {} };
+      }
     },
     account: {
       async get() {
@@ -631,7 +653,9 @@ function can(organization, resource, action) {
   if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false;
   return organization.permissions.some((p) => matches(p, resource, action));
 }
-function definePolicy(roles) {
+function definePolicy(given) {
+  const roles = Array.isArray(given) ? given : given.roles;
+  const resources = Array.isArray(given) ? [] : given.catalog ?? [];
   const entry = (p) => `${p.resource}:${p.action}`;
   const byName = new Map(roles.map((r) => [r.role, r]));
   const split = (permission) => {
@@ -646,6 +670,12 @@ function definePolicy(roles) {
       ...r.inherits ? { inherits: [...r.inherits] } : {},
       ...r.permissions ? { permissions: r.permissions.map((p) => ({ ...p })) } : {}
     })),
+    catalog: resources.map((c) => ({
+      resource: c.resource,
+      ...c.description !== void 0 ? { description: c.description } : {},
+      actions: [...c.actions],
+      ...c.attributes ? { attributes: { ...c.attributes } } : {}
+    })),
     roleNames: roles.map((r) => r.role),
     permissions: [...new Set(roles.flatMap((r) => (r.permissions ?? []).map(entry)))],
     can(organization, permission) {
@@ -667,6 +697,11 @@ function definePolicy(roles) {
       };
       walk(role);
       return [...out];
+    },
+    // The types did the work; this only hands the question on, as a method of
+    // the asker so it keeps its `this`.
+    check(asker, ...args) {
+      return asker.check(...args);
     }
   };
 }
@@ -785,11 +820,22 @@ var TEXTS = {
     memberLeaveConfirm: "Leave {org}? You will need an invitation to come back.",
     memberInviteAgain: "Send the invitation again",
     memberInvitationSent: "The invitation is on its way.",
+    organization: "Organization",
+    organizationRename: "Rename",
+    organizationRenamed: "The organization is now called {name}.",
+    organizationArchive: "Archive",
+    organizationArchiveConfirm: "Archive {org}? Its members will no longer reach it, and only the workspace can restore it.",
+    organizationArchived: "{org} was archived.",
+    organizationDelete: "Delete organization",
+    organizationDeleteConfirm: "Delete {org} for good? Its members lose it and this cannot be undone.",
+    organizationDeleted: "{org} was deleted.",
     yes: "Yes",
     cancel: "Cancel",
     errors: {
       not_allowed: "Your role in this organization does not allow that.",
       last_manager: "Somebody else must manage the members first: give that role to another member.",
+      last_owner: "An organization keeps at least one owner: make another member owner first.",
+      organization_not_found: "That organization no longer exists.",
       already_member: "That person already belongs to the organization. Change their role instead.",
       unknown_role: "Choose one of the roles offered.",
       user_not_active: "That account is disabled.",
@@ -941,11 +987,22 @@ var TEXTS = {
     memberLeaveConfirm: "\xBFSalir de {org}? Necesitar\xE1s una invitaci\xF3n para volver.",
     memberInviteAgain: "Enviar la invitaci\xF3n de nuevo",
     memberInvitationSent: "La invitaci\xF3n va en camino.",
+    organization: "Organizaci\xF3n",
+    organizationRename: "Cambiar nombre",
+    organizationRenamed: "La organizaci\xF3n ahora se llama {name}.",
+    organizationArchive: "Archivar",
+    organizationArchiveConfirm: "\xBFArchivar {org}? Sus miembros ya no podr\xE1n entrar y solo el espacio de trabajo puede restaurarla.",
+    organizationArchived: "{org} qued\xF3 archivada.",
+    organizationDelete: "Eliminar organizaci\xF3n",
+    organizationDeleteConfirm: "\xBFEliminar {org} para siempre? Sus miembros la pierden y no se puede deshacer.",
+    organizationDeleted: "{org} qued\xF3 eliminada.",
     yes: "S\xED",
     cancel: "Cancelar",
     errors: {
       not_allowed: "Tu rol en esta organizaci\xF3n no permite eso.",
       last_manager: "Primero alguien m\xE1s debe administrar los miembros: dale ese rol a otro miembro.",
+      last_owner: "Una organizaci\xF3n conserva al menos un propietario: primero haz propietario a otro miembro.",
+      organization_not_found: "Esa organizaci\xF3n ya no existe.",
       already_member: "Esa persona ya pertenece a la organizaci\xF3n. Cambia su rol.",
       unknown_role: "Escoge uno de los roles ofrecidos.",
       user_not_active: "Esa cuenta est\xE1 desactivada.",
@@ -1622,32 +1679,52 @@ function Account(props) {
     ] })
   ] });
 }
+var OWNER = "owner";
+function memberActions(seat, m) {
+  const reachable = m.role !== OWNER || seat.role === OWNER;
+  return {
+    changeRole: seat.can.manageMembers && reachable,
+    // Leaving is anybody's; removing somebody else is cauthy:members:remove.
+    remove: m.you || seat.can.removeMembers && reachable,
+    inviteAgain: seat.can.manageMembers && m.invited
+  };
+}
+function rolesToGive(seat, roles) {
+  return seat.role === OWNER ? roles : roles.filter((c) => c.role !== OWNER);
+}
 function OrganizationMembers(props) {
   const auth = useAuth();
   const { root } = useForm(props);
   const { f, done, setDone, run } = useSection(props);
-  const problem = f.error && f.error.field !== "email" ? f.error : null;
+  const problem = f.error && f.error.field !== "email" && f.error.field !== "name" ? f.error : null;
   const [seat, setSeat] = useState(void 0);
   const [members, setMembers] = useState(null);
   const [roles, setRoles] = useState([]);
   const [email, setEmail] = useState("");
   const [role, setRole] = useState("");
+  const [name, setName] = useState("");
   const [asking, setAsking] = useState(null);
+  const [gone, setGone] = useState(null);
   const id = props.organizationId;
   const when = props.formatDate ?? ((iso) => new Date(iso).toLocaleDateString());
   const load = async () => {
     const [list, people, choices] = await Promise.all([auth.organizations.list(), auth.organizations.members(id), auth.organizations.roles(id)]);
-    setSeat(list.find((o) => o.id === id) ?? null);
+    const mine = list.find((o) => o.id === id) ?? null;
+    setSeat(mine);
+    if (mine) setName(mine.name);
     setMembers(people);
     setRoles(choices ?? []);
-    if (choices && choices.length > 0 && !choices.some((c) => c.role === role)) setRole(choices[0].role);
+    const offered = mine ? rolesToGive(mine, choices ?? []) : [];
+    if (offered.length > 0 && !offered.some((c) => c.role === role)) setRole(offered[0].role);
   };
   useEffect(() => {
     void load();
   }, [id]);
+  if (gone !== null) return /* @__PURE__ */ jsx("div", { className: f.cx("account"), ...root, children: /* @__PURE__ */ jsx("p", { role: "status", className: f.cx("notice"), children: gone }) });
   if (seat === void 0) return /* @__PURE__ */ jsx("div", { className: f.cx("account"), ...root, "aria-busy": "true" });
   if (seat === null) return /* @__PURE__ */ jsx("div", { className: f.cx("account"), ...root, children: /* @__PURE__ */ jsx("p", { className: f.cx("notice"), children: f.t.organizationMissing }) });
   const manage = seat.can.manageMembers;
+  const giveable = rolesToGive(seat, roles);
   const label = (r) => roles.find((c) => c.role === r)?.name || r;
   const add = async (e) => {
     e.preventDefault();
@@ -1672,6 +1749,25 @@ function OrganizationMembers(props) {
     const r = await run(() => auth.organizations.inviteAgain(id, m.userId, { locale: props.locale }));
     if (r.ok) setDone(f.t.memberInvitationSent);
   };
+  const rename = async (e) => {
+    e.preventDefault();
+    const r = await run(() => auth.organizations.rename(id, name));
+    if (!r.ok) return;
+    setSeat(r.organization);
+    setName(r.organization.name);
+    setDone(f.t.organizationRenamed.replace("{name}", r.organization.name));
+  };
+  const close = async (how) => {
+    setAsking(null);
+    const r = await run(() => how === "archive" ? auth.organizations.archive(id) : auth.organizations.delete(id));
+    if (r.ok) setGone((how === "archive" ? f.t.organizationArchived : f.t.organizationDeleted).replace("{org}", seat.name));
+  };
+  const confirming = (text2, label2, yes) => /* @__PURE__ */ jsxs("span", { role: "group", "aria-label": label2, children: [
+    /* @__PURE__ */ jsx("span", { children: text2 }),
+    " ",
+    /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: yes, children: f.t.yes }),
+    /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(null), children: f.t.cancel })
+  ] });
   return /* @__PURE__ */ jsxs("div", { className: f.cx("account"), ...root, children: [
     /* @__PURE__ */ jsxs("section", { className: f.cx("section"), children: [
       /* @__PURE__ */ jsxs("h2", { className: f.cx("heading"), children: [
@@ -1682,23 +1778,14 @@ function OrganizationMembers(props) {
       problem && /* @__PURE__ */ jsx("p", { role: "alert", className: f.cx("error"), children: f.say(problem) }),
       members === null ? /* @__PURE__ */ jsxs(Fragment, { children: [
         /* @__PURE__ */ jsx("p", { className: f.cx("notice"), children: f.t.membersHidden }),
-        auth.session && (asking === auth.session.user.id ? /* @__PURE__ */ jsxs("span", { role: "group", "aria-label": f.t.memberLeave, children: [
-          /* @__PURE__ */ jsx("span", { children: f.t.memberLeaveConfirm.replace("{org}", seat.name) }),
-          " ",
-          /* @__PURE__ */ jsx(
-            f.Button,
-            {
-              type: "button",
-              disabled: f.busy,
-              className: f.cx("providerButton"),
-              onClick: () => void remove({ userId: auth.session.user.id, you: true }),
-              children: f.t.yes
-            }
-          ),
-          /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(null), children: f.t.cancel })
-        ] }) : /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(auth.session.user.id), children: f.t.memberLeave }))
+        auth.session && (asking === auth.session.user.id ? confirming(
+          f.t.memberLeaveConfirm.replace("{org}", seat.name),
+          f.t.memberLeave,
+          () => void remove({ userId: auth.session.user.id, you: true })
+        ) : /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(auth.session.user.id), children: f.t.memberLeave }))
       ] }) : /* @__PURE__ */ jsx("ul", { className: f.cx("sessions"), children: members.map((m) => {
         const who = m.name || m.email;
+        const may = memberActions(seat, m);
         return /* @__PURE__ */ jsxs("li", { className: f.cx("session"), children: [
           /* @__PURE__ */ jsxs("span", { children: [
             who,
@@ -1710,7 +1797,7 @@ function OrganizationMembers(props) {
             when(m.since)
           ] }),
           " ",
-          manage && roles.length > 0 ? /* @__PURE__ */ jsx(
+          may.changeRole && giveable.length > 0 ? /* @__PURE__ */ jsx(
             "select",
             {
               "aria-label": `${f.t.memberRole}: ${who}`,
@@ -1718,31 +1805,41 @@ function OrganizationMembers(props) {
               value: m.role,
               disabled: f.busy,
               onChange: (e) => void change(m, e.target.value),
-              children: roles.map((c) => /* @__PURE__ */ jsx("option", { value: c.role, children: c.name || c.role }, c.role))
+              children: (giveable.some((c) => c.role === m.role) ? giveable : [...roles.filter((c) => c.role === m.role), ...giveable]).map((c) => /* @__PURE__ */ jsx("option", { value: c.role, children: c.name || c.role }, c.role))
             }
           ) : /* @__PURE__ */ jsx("span", { children: label(m.role) }),
           " ",
-          asking === m.userId ? /* @__PURE__ */ jsxs("span", { role: "group", "aria-label": m.you ? f.t.memberLeave : f.t.memberRemove, children: [
-            /* @__PURE__ */ jsx("span", { children: m.you ? f.t.memberLeaveConfirm.replace("{org}", seat.name) : f.t.memberRemoveConfirm.replace("{who}", who) }),
-            " ",
-            /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void remove(m), children: f.t.yes }),
-            /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(null), children: f.t.cancel })
-          ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
-            manage && m.invited && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void inviteAgain(m), children: f.t.memberInviteAgain }),
-            (manage || m.you) && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(m.userId), children: m.you ? f.t.memberLeave : f.t.memberRemove })
+          asking === m.userId ? confirming(
+            m.you ? f.t.memberLeaveConfirm.replace("{org}", seat.name) : f.t.memberRemoveConfirm.replace("{who}", who),
+            m.you ? f.t.memberLeave : f.t.memberRemove,
+            () => void remove(m)
+          ) : /* @__PURE__ */ jsxs(Fragment, { children: [
+            may.inviteAgain && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void inviteAgain(m), children: f.t.memberInviteAgain }),
+            may.remove && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(m.userId), children: m.you ? f.t.memberLeave : f.t.memberRemove })
           ] })
         ] }, m.userId);
       }) }),
       done && /* @__PURE__ */ jsx("p", { role: "status", className: f.cx("notice"), children: done })
     ] }),
-    manage && roles.length > 0 && /* @__PURE__ */ jsxs("form", { className: f.cx("section"), onSubmit: add, noValidate: true, children: [
+    manage && giveable.length > 0 && /* @__PURE__ */ jsxs("form", { className: f.cx("section"), onSubmit: add, noValidate: true, children: [
       /* @__PURE__ */ jsx("h2", { className: f.cx("heading"), children: f.t.memberAdd }),
       /* @__PURE__ */ jsx(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "off", required: true, onChange: setEmail }),
       /* @__PURE__ */ jsxs("label", { className: f.cx("field"), children: [
         /* @__PURE__ */ jsx("span", { className: f.cx("label"), children: f.t.memberRole }),
-        /* @__PURE__ */ jsx("select", { name: "role", className: f.cx("input"), value: role, onChange: (e) => setRole(e.target.value), children: roles.map((c) => /* @__PURE__ */ jsx("option", { value: c.role, children: c.name || c.role }, c.role)) })
+        /* @__PURE__ */ jsx("select", { name: "role", className: f.cx("input"), value: role, onChange: (e) => setRole(e.target.value), children: giveable.map((c) => /* @__PURE__ */ jsx("option", { value: c.role, children: c.name || c.role }, c.role)) })
       ] }),
       /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.memberAdd })
+    ] }),
+    (seat.can.update || seat.can.archive || seat.can.delete) && /* @__PURE__ */ jsxs("section", { className: f.cx("section"), children: [
+      /* @__PURE__ */ jsx("h2", { className: f.cx("heading"), children: f.t.organization }),
+      seat.can.update && /* @__PURE__ */ jsxs("form", { onSubmit: rename, noValidate: true, children: [
+        /* @__PURE__ */ jsx(Field, { f, name: "name", type: "text", label: f.t.name, value: name, autoComplete: "organization", required: true, onChange: setName }),
+        /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.organizationRename })
+      ] }),
+      asking === "archive" ? confirming(f.t.organizationArchiveConfirm.replace("{org}", seat.name), f.t.organizationArchive, () => void close("archive")) : asking === "delete" ? confirming(f.t.organizationDeleteConfirm.replace("{org}", seat.name), f.t.organizationDelete, () => void close("delete")) : /* @__PURE__ */ jsxs(Fragment, { children: [
+        seat.can.archive && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking("archive"), children: f.t.organizationArchive }),
+        seat.can.delete && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking("delete"), children: f.t.organizationDelete })
+      ] })
     ] })
   ] });
 }