cauthy-auth 0.28.1 → 0.30.0

package/dist/react.d.ts

@@ -85,6 +85,8 @@ interface Permitted {
     permissions?: string[];
     /** Entries the person is denied whatever else allows them. */
     denied?: string[];
+    /** Permissions with a condition: in neither list, so `can` never counts them. Ask with `auth.check`. */
+    conditional?: ConditionalPermission[];
 }
 /**
  * Whether the person may do an action on a resource in an organization:
@@ -93,6 +95,11 @@ interface Permitted {
  * An organization of a system that keeps no catalog in Cauthy carries no
  * permissions, and the answer is `false`: decide by its `role` instead.
  *
+ * A permission with a condition (`organization.conditional`) is not in the
+ * lists, so `can` answers `false` for what only it allows: the condition reads
+ * the record at hand, which only Cauthy can weigh. Ask with `auth.check`
+ * (`organizations.check` in the browser).
+ *
  *   if (!can(organization, 'invoicing', 'write')) return forbidden()
  */
 declare function can(organization: Permitted | null | undefined, resource: string, action: string): boolean;
@@ -101,6 +108,21 @@ interface PolicyPermission {
     kind?: string;
     resource: string;
     action: string;
+    /**
+     * When it holds, in CEL: `resource.attrs.amount <= 1000000`. A permission
+     * with one is decided by Cauthy per question (`auth.check`), never by `can`.
+     */
+    condition?: string;
+}
+/** The type of an attribute a condition may read: `list` is any JSON array. */
+type AttributeType = 'string' | 'number' | 'bool' | 'list';
+/** A resource of a system's catalog: the actions done on it and the attributes its conditions read. */
+interface CatalogResource {
+    resource: string;
+    description?: string;
+    actions: string[];
+    /** Name → type, as `resource.attrs.<name>` in a condition. */
+    attributes?: Record<string, AttributeType>;
 }
 interface PolicyRole {
     role: string;
@@ -110,17 +132,28 @@ interface PolicyRole {
     inherits?: string[];
     permissions?: PolicyPermission[];
 }
+type PermissionShape = {
+    readonly kind?: string;
+    readonly resource: string;
+    readonly action: string;
+    readonly condition?: string;
+};
 /** A role as `definePolicy` reads it: any `PolicyRole`, kept as written. */
 type RoleShape = {
     readonly role: string;
     readonly name?: string;
     readonly description?: string;
     readonly inherits?: readonly string[];
-    readonly permissions?: readonly {
-        readonly kind?: string;
-        readonly resource: string;
-        readonly action: string;
-    }[];
+    readonly permissions?: readonly PermissionShape[];
+};
+/** A resource as `definePolicy` reads it: any `CatalogResource`, kept as written. */
+type ResourceShape = {
+    readonly resource: string;
+    readonly description?: string;
+    readonly actions: readonly string[];
+    readonly attributes?: {
+        readonly [name: string]: AttributeType;
+    };
 };
 type Named<S extends string> = S extends '*' ? string : S;
 type PermissionsIn<R> = R extends {
@@ -129,13 +162,56 @@ type PermissionsIn<R> = R extends {
     readonly resource: infer Res extends string;
     readonly action: infer Act extends string;
 } ? `${Named<Res>}:${Named<Act>}` : never : never;
+type ValueOf<T> = T extends 'string' ? string : T extends 'number' ? number : T extends 'bool' ? boolean : T extends 'list' ? unknown[] : never;
+/** What a check may say about one declared resource. */
+type QuestionAbout<E> = E extends {
+    readonly resource: infer R extends string;
+    readonly actions: readonly (infer A extends string)[];
+} ? {
+    resource: R;
+    action: A;
+    attributes?: E extends {
+        readonly attributes: infer T;
+    } ? {
+        [K in keyof T]?: ValueOf<T[K]>;
+    } : Record<string, never>;
+    resourceId?: string;
+    ownerId?: string;
+} : never;
+/**
+ * What a role of a catalog that declares its resources may name: a declared
+ * resource with one of its actions, or "*", or one of Cauthy's own powers.
+ */
+type PermissionFor<C extends readonly ResourceShape[]> = {
+    readonly kind?: string;
+    readonly condition?: string;
+} & ((C[number] extends infer E ? E extends {
+    readonly resource: infer R extends string;
+    readonly actions: readonly (infer A extends string)[];
+} ? {
+    readonly resource: R;
+    readonly action: A | '*';
+} : never : never) | {
+    readonly resource: '*';
+    readonly action: string;
+} | {
+    readonly resource: `cauthy:${string}`;
+    readonly action: string;
+});
+type RoleFor<C extends readonly ResourceShape[]> = Omit<RoleShape, 'permissions'> & {
+    readonly permissions?: readonly PermissionFor<C>[];
+};
 /** The roles a catalog names: `RoleOf<typeof policy>`. */
-type RoleOf<P> = P extends Policy<infer R, string> ? R : never;
+type RoleOf<P> = P extends Policy<infer R, any, any> ? R : never;
 /** The "resource:action" permissions a catalog names: `PermissionOf<typeof policy>`. */
-type PermissionOf<P> = P extends Policy<string, infer X> ? X : never;
-interface Policy<Role extends string = string, Permission extends string = string> {
+type PermissionOf<P> = P extends Policy<any, infer X, any> ? X : never;
+/** The fields of a question: whatever else the asker takes (the organization, the person) passes through. */
+type QuestionKeys = keyof CheckQuestion;
+interface Policy<Role extends string = string, Permission extends string = string, Question extends CheckQuestion = CheckQuestion> {
     /** The catalog as Cauthy takes it: `pushPolicy({ roles: policy.roles })`. */
     roles: PolicyRole[];
+    /** The resources the system declares, as Cauthy takes them; empty when it declares none. */
+    catalog: CatalogResource[];
     /** Every role's name. */
     roleNames: Role[];
     /** Every permission some role has, as "resource:action". */
@@ -143,7 +219,8 @@ interface Policy<Role extends string = string, Permission extends string = strin
     /**
      * Whether the person may do this in the organization: `can(org, 'ledger:write')`.
      * It reads what Cauthy sent with the session, so a catalog edited in Cauthy
-     * since this file was written is still what decides.
+     * since this file was written is still what decides. A permission with a
+     * condition is not there: ask with `check`.
      */
     can(organization: Permitted | null | undefined, permission: Permission): boolean;
     /** Whether the person's role in the organization is one of these. */
@@ -155,9 +232,30 @@ interface Policy<Role extends string = string, Permission extends string = strin
      * role, never for deciding about a person (their exceptions are not here).
      */
     permissionsOf(role: Role): Permission[];
+    /**
+     * Asks Cauthy, with the resource, action and attributes typed by the
+     * catalog. Give it whoever asks: the server's `auth` with the request,
+     * the browser's `organizations`, or the application's `system`.
+     *
+     *   await policy.check(auth, request, { organization, resource: 'invoices', action: 'approve', attributes: { amount: 500 } })
+     *   await policy.check(auth.system, { organizationId, userId, resource: 'invoices', action: 'read' })
+     */
+    check<I extends CheckQuestion>(asker: {
+        check(input: I): Promise<CheckResult>;
+    }, input: Omit<I, QuestionKeys> & Question): Promise<CheckResult>;
+    check<R, I extends CheckQuestion>(asker: {
+        check(request: R, input: I): Promise<CheckResult>;
+    }, request: R, input: Omit<I, QuestionKeys> & Question): Promise<CheckResult>;
+}
+/** A catalog with its resources declared, for `definePolicy`. */
+interface PolicyDefinition<C extends readonly ResourceShape[], T extends readonly RoleShape[]> {
+    catalog: C;
+    roles: T;
 }
 /** Gives a catalog of roles its types. See the top of this section. */
 declare function definePolicy<const T extends readonly RoleShape[]>(roles: T): Policy<T[number]['role'], PermissionsIn<T[number]>>;
+/** Gives a catalog of resources and roles its types: a role names only what the catalog declares. */
+declare function definePolicy<const C extends readonly ResourceShape[], const T extends readonly RoleFor<C>[]>(definition: PolicyDefinition<C, T>): Policy<T[number]['role'], PermissionsIn<T[number]>, QuestionAbout<C[number]>>;
 
 /** The person signed in. Every moment is UTC. */
 interface SessionUser {
@@ -200,6 +298,54 @@ interface SessionOrganization {
     permissions?: string[];
     /** What the person is denied here, whatever else allows it. */
     denied?: string[];
+    /**
+     * Permissions that hold only when their condition does (an amount under a
+     * limit, the person's own records…). They are in neither list above: `can`
+     * answers no for them, and `auth.check` asks Cauthy. Present, maybe empty,
+     * whenever `permissions` is.
+     */
+    conditional?: ConditionalPermission[];
+}
+/** A permission with a condition: Cauthy decides it per question (`auth.check`). */
+interface ConditionalPermission {
+    resource: string;
+    action: string;
+    effect: 'allow' | 'deny';
+}
+/** What to ask Cauthy about: an action on a resource, with what the conditions read of it. */
+interface CheckQuestion {
+    resource: string;
+    action: string;
+    /** What a condition reads as `resource.attrs`: `{ amount: 500 }`. */
+    attributes?: Record<string, unknown>;
+    /** The record's id, as a condition reads it (`resource.id`). */
+    resourceId?: string;
+    /** Whose the record is (`resource.owner_id`): `resource.owner_id == subject.id`. */
+    ownerId?: string;
+}
+/** An organization, by its id or as the session has it. */
+type OrganizationRef = string | {
+    id: string;
+};
+/** The rule that decided a check. */
+interface CheckRule {
+    /** A permission of the person's role, or an exception given to the person. */
+    source: 'role' | 'exception';
+    /** The role, when `source` is `role`. */
+    role?: string;
+    kind: string;
+    resource: string;
+    action: string;
+    effect: 'allow' | 'deny';
+    condition?: string;
+}
+/** Cauthy's answer to a check. */
+interface CheckResult {
+    allowed: boolean;
+    /** Why, in words: "allowed by role accountant: invoices:approve". */
+    reason: string;
+    /** The rule that decided; absent when none did (nothing allows it). */
+    rule?: CheckRule;
 }
 /** What the browser is told of a session: who, and their organizations — never a token. */
 interface PublicSession {
@@ -385,19 +531,29 @@ interface ConnectedAgent {
     connectedAt: string;
     lastUsedAt: string;
 }
-/** An organization the person belongs to, with what their role lets them do with its people. */
+/** An organization the person belongs to, with what their role lets them do with it and its people. */
 interface OrganizationSeat {
     id: string;
-    /** The client system it is of (`pondari`). */
+    /** The client system it is of (`acme-crm`). */
     system: string;
     name: string;
     kind: string;
     /** The person's role in it. */
     role: string;
-    /** Cauthy's member powers, from the system's catalog: cauthy:members read and manage. */
+    /**
+     * Cauthy's reserved powers, from the system's catalog. `manageMembers`
+     * (cauthy:members:manage) adds, invites and changes roles; removing another
+     * member is `removeMembers` (cauthy:members:remove), and anybody may leave.
+     * `update`, `archive` and `delete` are cauthy:organization's: rename it,
+     * archive it, delete it for good.
+     */
     can: {
         readMembers: boolean;
         manageMembers: boolean;
+        removeMembers: boolean;
+        update: boolean;
+        archive: boolean;
+        delete: boolean;
     };
 }
 /** A person of an organization, as a member who may see them reads it. */
@@ -427,8 +583,12 @@ interface OrganizationRoleChoice {
 }
 /**
  * The signed-in person's organizations, and their people. Seeing them needs
- * cauthy:members read in the person's role; changing them needs manage. Cauthy
- * decides, with the person's own session: the application authorizes nothing.
+ * cauthy:members read in the person's role; changing them needs manage, and
+ * removing someone needs remove. The organization itself is renamed, archived
+ * or deleted with cauthy:organization update, archive or delete. Only an
+ * `owner` gives the owner role or changes an owner, and the last owner stays
+ * (`last_owner`). Cauthy decides, with the person's own session: the
+ * application authorizes nothing.
  */
 interface OrganizationsClient {
     /** The organizations the person belongs to; one system's only with `system`. */
@@ -460,6 +620,31 @@ interface OrganizationsClient {
     }): Promise<AuthResult<'sent', {
         userId: string;
     }>>;
+    /** Gives the organization a new name (cauthy:organization update). */
+    rename(organizationId: string, name: string): Promise<AuthResult<'renamed', {
+        organization: OrganizationSeat;
+    }>>;
+    /** Archives the organization: its members no longer reach it, and only the workspace restores it. */
+    archive(organizationId: string): Promise<AuthResult<'archived', {
+        organizationId: string;
+    }>>;
+    /** Deletes the organization for good. */
+    delete(organizationId: string): Promise<AuthResult<'deleted', {
+        organizationId: string;
+    }>>;
+    /**
+     * Asks Cauthy, through the application's server, whether the person may do
+     * an action on a resource in the organization, with what its conditions
+     * read. A question that could not be asked is a no, with `error` saying why.
+     *
+     *   const r = await organizations.check({ organization, resource: 'invoices', action: 'approve', attributes: { amount: 500 } })
+     *   if (r.allowed) showApprove()
+     */
+    check(question: CheckQuestion & {
+        organization: OrganizationRef;
+    }): Promise<CheckResult & {
+        error?: AuthError;
+    }>;
 }
 interface AccountSession {
     /** "Mac · Chrome", or "" when the browser did not say. */
@@ -1027,6 +1212,15 @@ interface AuthTexts {
     memberLeaveConfirm: string;
     memberInviteAgain: string;
     memberInvitationSent: string;
+    organization: string;
+    organizationRename: string;
+    organizationRenamed: string;
+    organizationArchive: string;
+    organizationArchiveConfirm: string;
+    organizationArchived: string;
+    organizationDelete: string;
+    organizationDeleteConfirm: string;
+    organizationDeleted: string;
     yes: string;
     cancel: string;
     /** By error code; one missing shows what the server said. */
@@ -1144,10 +1338,12 @@ interface OrganizationMembersProps extends Omit<AuthFormProps, 'links' | 'return
  * The people of one of the signed-in person's organizations, administered
  * from the application. What it offers follows the person's role in the
  * system's catalog: cauthy:members read lists the people; manage adds them by
- * address (one with no account is invited), changes their role, sends an
- * invitation again and removes them. Anybody may leave. Cauthy checks each
- * change with the person's own session; the application authorizes nothing.
- * Like the other forms, it carries no styles.
+ * address (one with no account is invited), changes their role and sends an
+ * invitation again; remove removes them. Anybody may leave. Only an owner
+ * gives the owner role or changes an owner. cauthy:organization update,
+ * archive and delete rename the organization, archive it, delete it. Cauthy
+ * checks each change with the person's own session; the application
+ * authorizes nothing. Like the other forms, it carries no styles.
  */
 declare function OrganizationMembers(props: OrganizationMembersProps): react.JSX.Element;
 

package/dist/react.js

@@ -321,6 +321,12 @@ function checkOrganization(value, required = false) {
   if (v.length > MAX_ORGANIZATION) return { field: "organization", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
   return null;
 }
+function checkOrganizationName(value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return { field: "name", code: "required", message: "Enter the organization's name." };
+  if (v.length > MAX_ORGANIZATION) return { field: "name", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
+  return null;
+}
 function checkCode(value) {
   const v = typeof value === "string" ? value.trim() : "";
   if (v === "") return { field: "code", code: "required", message: "Enter the code." };
@@ -573,7 +579,23 @@ function createAuthClient(options = {}) {
       add: (id, f) => post("/me/organizations/members/add", { organizationId: id, email: f.email, role: f.role, name: f.name ?? "", locale: f.locale ?? "" }, checkEmail(f.email)),
       setRole: (id, userId, role) => post("/me/organizations/members/role", { organizationId: id, userId, role }, null),
       remove: (id, userId) => post("/me/organizations/members/remove", { organizationId: id, userId }, null),
-      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null)
+      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null),
+      rename: (id, name) => post("/me/organizations/rename", { organizationId: id, name }, checkOrganizationName(name)),
+      archive: (id) => post("/me/organizations/archive", { organizationId: id }, null),
+      delete: (id) => post("/me/organizations/delete", { organizationId: id }, null),
+      async check(q) {
+        const organizationId = typeof q.organization === "string" ? q.organization : q.organization?.id ?? "";
+        const r = await post("/me/organizations/check", {
+          organizationId,
+          resource: q.resource,
+          action: q.action,
+          ...q.attributes !== void 0 ? { attributes: q.attributes } : {},
+          ...q.resourceId !== void 0 ? { resourceId: q.resourceId } : {},
+          ...q.ownerId !== void 0 ? { ownerId: q.ownerId } : {}
+        }, null);
+        if (!r.ok) return { allowed: false, reason: r.error.message, error: r.error };
+        return { allowed: r.allowed === true, reason: String(r.reason ?? ""), ...r.rule ? { rule: r.rule } : {} };
+      }
     },
     account: {
       async get() {
@@ -669,7 +691,9 @@ function can(organization, resource, action) {
   if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false;
   return organization.permissions.some((p) => matches(p, resource, action));
 }
-function definePolicy(roles) {
+function definePolicy(given) {
+  const roles = Array.isArray(given) ? given : given.roles;
+  const resources = Array.isArray(given) ? [] : given.catalog ?? [];
   const entry = (p) => `${p.resource}:${p.action}`;
   const byName = new Map(roles.map((r) => [r.role, r]));
   const split = (permission) => {
@@ -684,6 +708,12 @@ function definePolicy(roles) {
       ...r.inherits ? { inherits: [...r.inherits] } : {},
       ...r.permissions ? { permissions: r.permissions.map((p) => ({ ...p })) } : {}
     })),
+    catalog: resources.map((c) => ({
+      resource: c.resource,
+      ...c.description !== void 0 ? { description: c.description } : {},
+      actions: [...c.actions],
+      ...c.attributes ? { attributes: { ...c.attributes } } : {}
+    })),
     roleNames: roles.map((r) => r.role),
     permissions: [...new Set(roles.flatMap((r) => (r.permissions ?? []).map(entry)))],
     can(organization, permission) {
@@ -705,6 +735,11 @@ function definePolicy(roles) {
       };
       walk(role);
       return [...out];
+    },
+    // The types did the work; this only hands the question on, as a method of
+    // the asker so it keeps its `this`.
+    check(asker, ...args) {
+      return asker.check(...args);
     }
   };
 }
@@ -823,11 +858,22 @@ var TEXTS = {
     memberLeaveConfirm: "Leave {org}? You will need an invitation to come back.",
     memberInviteAgain: "Send the invitation again",
     memberInvitationSent: "The invitation is on its way.",
+    organization: "Organization",
+    organizationRename: "Rename",
+    organizationRenamed: "The organization is now called {name}.",
+    organizationArchive: "Archive",
+    organizationArchiveConfirm: "Archive {org}? Its members will no longer reach it, and only the workspace can restore it.",
+    organizationArchived: "{org} was archived.",
+    organizationDelete: "Delete organization",
+    organizationDeleteConfirm: "Delete {org} for good? Its members lose it and this cannot be undone.",
+    organizationDeleted: "{org} was deleted.",
     yes: "Yes",
     cancel: "Cancel",
     errors: {
       not_allowed: "Your role in this organization does not allow that.",
       last_manager: "Somebody else must manage the members first: give that role to another member.",
+      last_owner: "An organization keeps at least one owner: make another member owner first.",
+      organization_not_found: "That organization no longer exists.",
       already_member: "That person already belongs to the organization. Change their role instead.",
       unknown_role: "Choose one of the roles offered.",
       user_not_active: "That account is disabled.",
@@ -979,11 +1025,22 @@ var TEXTS = {
     memberLeaveConfirm: "\xBFSalir de {org}? Necesitar\xE1s una invitaci\xF3n para volver.",
     memberInviteAgain: "Enviar la invitaci\xF3n de nuevo",
     memberInvitationSent: "La invitaci\xF3n va en camino.",
+    organization: "Organizaci\xF3n",
+    organizationRename: "Cambiar nombre",
+    organizationRenamed: "La organizaci\xF3n ahora se llama {name}.",
+    organizationArchive: "Archivar",
+    organizationArchiveConfirm: "\xBFArchivar {org}? Sus miembros ya no podr\xE1n entrar y solo el espacio de trabajo puede restaurarla.",
+    organizationArchived: "{org} qued\xF3 archivada.",
+    organizationDelete: "Eliminar organizaci\xF3n",
+    organizationDeleteConfirm: "\xBFEliminar {org} para siempre? Sus miembros la pierden y no se puede deshacer.",
+    organizationDeleted: "{org} qued\xF3 eliminada.",
     yes: "S\xED",
     cancel: "Cancelar",
     errors: {
       not_allowed: "Tu rol en esta organizaci\xF3n no permite eso.",
       last_manager: "Primero alguien m\xE1s debe administrar los miembros: dale ese rol a otro miembro.",
+      last_owner: "Una organizaci\xF3n conserva al menos un propietario: primero haz propietario a otro miembro.",
+      organization_not_found: "Esa organizaci\xF3n ya no existe.",
       already_member: "Esa persona ya pertenece a la organizaci\xF3n. Cambia su rol.",
       unknown_role: "Escoge uno de los roles ofrecidos.",
       user_not_active: "Esa cuenta est\xE1 desactivada.",
@@ -1660,32 +1717,52 @@ function Account(props) {
     ] })
   ] });
 }
+var OWNER = "owner";
+function memberActions(seat, m) {
+  const reachable = m.role !== OWNER || seat.role === OWNER;
+  return {
+    changeRole: seat.can.manageMembers && reachable,
+    // Leaving is anybody's; removing somebody else is cauthy:members:remove.
+    remove: m.you || seat.can.removeMembers && reachable,
+    inviteAgain: seat.can.manageMembers && m.invited
+  };
+}
+function rolesToGive(seat, roles) {
+  return seat.role === OWNER ? roles : roles.filter((c) => c.role !== OWNER);
+}
 function OrganizationMembers(props) {
   const auth = useAuth();
   const { root } = useForm(props);
   const { f, done, setDone, run } = useSection(props);
-  const problem = f.error && f.error.field !== "email" ? f.error : null;
+  const problem = f.error && f.error.field !== "email" && f.error.field !== "name" ? f.error : null;
   const [seat, setSeat] = (0, import_react.useState)(void 0);
   const [members, setMembers] = (0, import_react.useState)(null);
   const [roles, setRoles] = (0, import_react.useState)([]);
   const [email, setEmail] = (0, import_react.useState)("");
   const [role, setRole] = (0, import_react.useState)("");
+  const [name, setName] = (0, import_react.useState)("");
   const [asking, setAsking] = (0, import_react.useState)(null);
+  const [gone, setGone] = (0, import_react.useState)(null);
   const id = props.organizationId;
   const when = props.formatDate ?? ((iso) => new Date(iso).toLocaleDateString());
   const load = async () => {
     const [list, people, choices] = await Promise.all([auth.organizations.list(), auth.organizations.members(id), auth.organizations.roles(id)]);
-    setSeat(list.find((o) => o.id === id) ?? null);
+    const mine = list.find((o) => o.id === id) ?? null;
+    setSeat(mine);
+    if (mine) setName(mine.name);
     setMembers(people);
     setRoles(choices ?? []);
-    if (choices && choices.length > 0 && !choices.some((c) => c.role === role)) setRole(choices[0].role);
+    const offered = mine ? rolesToGive(mine, choices ?? []) : [];
+    if (offered.length > 0 && !offered.some((c) => c.role === role)) setRole(offered[0].role);
   };
   (0, import_react.useEffect)(() => {
     void load();
   }, [id]);
+  if (gone !== null) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("account"), ...root, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: gone }) });
   if (seat === void 0) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("account"), ...root, "aria-busy": "true" });
   if (seat === null) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: f.cx("account"), ...root, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.organizationMissing }) });
   const manage = seat.can.manageMembers;
+  const giveable = rolesToGive(seat, roles);
   const label = (r) => roles.find((c) => c.role === r)?.name || r;
   const add = async (e) => {
     e.preventDefault();
@@ -1710,6 +1787,25 @@ function OrganizationMembers(props) {
     const r = await run(() => auth.organizations.inviteAgain(id, m.userId, { locale: props.locale }));
     if (r.ok) setDone(f.t.memberInvitationSent);
   };
+  const rename = async (e) => {
+    e.preventDefault();
+    const r = await run(() => auth.organizations.rename(id, name));
+    if (!r.ok) return;
+    setSeat(r.organization);
+    setName(r.organization.name);
+    setDone(f.t.organizationRenamed.replace("{name}", r.organization.name));
+  };
+  const close = async (how) => {
+    setAsking(null);
+    const r = await run(() => how === "archive" ? auth.organizations.archive(id) : auth.organizations.delete(id));
+    if (r.ok) setGone((how === "archive" ? f.t.organizationArchived : f.t.organizationDeleted).replace("{org}", seat.name));
+  };
+  const confirming = (text2, label2, yes) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { role: "group", "aria-label": label2, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: text2 }),
+    " ",
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: yes, children: f.t.yes }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(null), children: f.t.cancel })
+  ] });
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("account"), ...root, children: [
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: f.cx("section"), children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("h2", { className: f.cx("heading"), children: [
@@ -1720,23 +1816,14 @@ function OrganizationMembers(props) {
       problem && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(problem) }),
       members === null ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.membersHidden }),
-        auth.session && (asking === auth.session.user.id ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { role: "group", "aria-label": f.t.memberLeave, children: [
-          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: f.t.memberLeaveConfirm.replace("{org}", seat.name) }),
-          " ",
-          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-            f.Button,
-            {
-              type: "button",
-              disabled: f.busy,
-              className: f.cx("providerButton"),
-              onClick: () => void remove({ userId: auth.session.user.id, you: true }),
-              children: f.t.yes
-            }
-          ),
-          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(null), children: f.t.cancel })
-        ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(auth.session.user.id), children: f.t.memberLeave }))
+        auth.session && (asking === auth.session.user.id ? confirming(
+          f.t.memberLeaveConfirm.replace("{org}", seat.name),
+          f.t.memberLeave,
+          () => void remove({ userId: auth.session.user.id, you: true })
+        ) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(auth.session.user.id), children: f.t.memberLeave }))
       ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: f.cx("sessions"), children: members.map((m) => {
         const who = m.name || m.email;
+        const may = memberActions(seat, m);
         return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: f.cx("session"), children: [
           /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { children: [
             who,
@@ -1748,7 +1835,7 @@ function OrganizationMembers(props) {
             when(m.since)
           ] }),
           " ",
-          manage && roles.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          may.changeRole && giveable.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
             "select",
             {
               "aria-label": `${f.t.memberRole}: ${who}`,
@@ -1756,31 +1843,41 @@ function OrganizationMembers(props) {
               value: m.role,
               disabled: f.busy,
               onChange: (e) => void change(m, e.target.value),
-              children: roles.map((c) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: c.role, children: c.name || c.role }, c.role))
+              children: (giveable.some((c) => c.role === m.role) ? giveable : [...roles.filter((c) => c.role === m.role), ...giveable]).map((c) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: c.role, children: c.name || c.role }, c.role))
             }
           ) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: label(m.role) }),
           " ",
-          asking === m.userId ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { role: "group", "aria-label": m.you ? f.t.memberLeave : f.t.memberRemove, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: m.you ? f.t.memberLeaveConfirm.replace("{org}", seat.name) : f.t.memberRemoveConfirm.replace("{who}", who) }),
-            " ",
-            /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void remove(m), children: f.t.yes }),
-            /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(null), children: f.t.cancel })
-          ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
-            manage && m.invited && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void inviteAgain(m), children: f.t.memberInviteAgain }),
-            (manage || m.you) && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(m.userId), children: m.you ? f.t.memberLeave : f.t.memberRemove })
+          asking === m.userId ? confirming(
+            m.you ? f.t.memberLeaveConfirm.replace("{org}", seat.name) : f.t.memberRemoveConfirm.replace("{who}", who),
+            m.you ? f.t.memberLeave : f.t.memberRemove,
+            () => void remove(m)
+          ) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+            may.inviteAgain && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void inviteAgain(m), children: f.t.memberInviteAgain }),
+            may.remove && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(m.userId), children: m.you ? f.t.memberLeave : f.t.memberRemove })
           ] })
         ] }, m.userId);
       }) }),
       done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: done })
     ] }),
-    manage && roles.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("section"), onSubmit: add, noValidate: true, children: [
+    manage && giveable.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("section"), onSubmit: add, noValidate: true, children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.memberAdd }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "off", required: true, onChange: setEmail }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("field"), children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: f.cx("label"), children: f.t.memberRole }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("select", { name: "role", className: f.cx("input"), value: role, onChange: (e) => setRole(e.target.value), children: roles.map((c) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: c.role, children: c.name || c.role }, c.role)) })
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("select", { name: "role", className: f.cx("input"), value: role, onChange: (e) => setRole(e.target.value), children: giveable.map((c) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: c.role, children: c.name || c.role }, c.role)) })
       ] }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.memberAdd })
+    ] }),
+    (seat.can.update || seat.can.archive || seat.can.delete) && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: f.cx("section"), children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.organization }),
+      seat.can.update && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { onSubmit: rename, noValidate: true, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "name", type: "text", label: f.t.name, value: name, autoComplete: "organization", required: true, onChange: setName }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.organizationRename })
+      ] }),
+      asking === "archive" ? confirming(f.t.organizationArchiveConfirm.replace("{org}", seat.name), f.t.organizationArchive, () => void close("archive")) : asking === "delete" ? confirming(f.t.organizationDeleteConfirm.replace("{org}", seat.name), f.t.organizationDelete, () => void close("delete")) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+        seat.can.archive && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking("archive"), children: f.t.organizationArchive }),
+        seat.can.delete && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking("delete"), children: f.t.organizationDelete })
+      ] })
     ] })
   ] });
 }