cauthy-auth 0.28.1 → 0.30.0

package/dist/{system-Bn8uckvQ.d.ts → system-BIYbS7h2.d.ts}

@@ -1,113 +1,6 @@
 import { JWK } from 'jose';
 import { CauthyTheme } from './theme.js';
 
-/** The part of an organization that says what its member may do. */
-interface Permitted {
-    /** "resource:action" entries the person is allowed; "*" is any. Absent when the system keeps no catalog in Cauthy. */
-    permissions?: string[];
-    /** Entries the person is denied whatever else allows them. */
-    denied?: string[];
-}
-/**
- * Whether the person may do an action on a resource in an organization:
- * allowed by some entry, and denied by none. A denial wins.
- *
- * An organization of a system that keeps no catalog in Cauthy carries no
- * permissions, and the answer is `false`: decide by its `role` instead.
- *
- *   if (!can(organization, 'invoicing', 'write')) return forbidden()
- */
-declare function can(organization: Permitted | null | undefined, resource: string, action: string): boolean;
-/** Something a role may do: an action on a resource, in organizations of a kind ("*", the default, is every kind). */
-interface PolicyPermission {
-    kind?: string;
-    resource: string;
-    action: string;
-}
-interface PolicyRole {
-    role: string;
-    name?: string;
-    description?: string;
-    /** Roles whose permissions this one has as well. */
-    inherits?: string[];
-    permissions?: PolicyPermission[];
-}
-/** A role as `definePolicy` reads it: any `PolicyRole`, kept as written. */
-type RoleShape = {
-    readonly role: string;
-    readonly name?: string;
-    readonly description?: string;
-    readonly inherits?: readonly string[];
-    readonly permissions?: readonly {
-        readonly kind?: string;
-        readonly resource: string;
-        readonly action: string;
-    }[];
-};
-type Named<S extends string> = S extends '*' ? string : S;
-type PermissionsIn<R> = R extends {
-    readonly permissions: readonly (infer P)[];
-} ? P extends {
-    readonly resource: infer Res extends string;
-    readonly action: infer Act extends string;
-} ? `${Named<Res>}:${Named<Act>}` : never : never;
-/** The roles a catalog names: `RoleOf<typeof policy>`. */
-type RoleOf<P> = P extends Policy<infer R, string> ? R : never;
-/** The "resource:action" permissions a catalog names: `PermissionOf<typeof policy>`. */
-type PermissionOf<P> = P extends Policy<string, infer X> ? X : never;
-interface Policy<Role extends string = string, Permission extends string = string> {
-    /** The catalog as Cauthy takes it: `pushPolicy({ roles: policy.roles })`. */
-    roles: PolicyRole[];
-    /** Every role's name. */
-    roleNames: Role[];
-    /** Every permission some role has, as "resource:action". */
-    permissions: Permission[];
-    /**
-     * Whether the person may do this in the organization: `can(org, 'ledger:write')`.
-     * It reads what Cauthy sent with the session, so a catalog edited in Cauthy
-     * since this file was written is still what decides.
-     */
-    can(organization: Permitted | null | undefined, permission: Permission): boolean;
-    /** Whether the person's role in the organization is one of these. */
-    hasRole(organization: {
-        role: string;
-    } | null | undefined, ...roles: Role[]): boolean;
-    /**
-     * What a role may do by this catalog, with what it inherits: for showing a
-     * role, never for deciding about a person (their exceptions are not here).
-     */
-    permissionsOf(role: Role): Permission[];
-}
-/** Gives a catalog of roles its types. See the top of this section. */
-declare function definePolicy<const T extends readonly RoleShape[]>(roles: T): Policy<T[number]['role'], PermissionsIn<T[number]>>;
-/**
- * A TypeScript module that defines the catalog given, for `cauthy-auth policy
- * --pull` to write: the application's types then come from the catalog
- * Cauthy has.
- */
-declare function policySource(system: string, roles: PolicyRole[]): string;
-/** Reads a system's catalog of roles from Cauthy, with a personal access token. */
-declare function pullPolicy(o?: Omit<PushPolicyOptions, 'roles'>): Promise<PolicyRole[]>;
-interface PushPolicyOptions {
-    /** The system whose catalog this is. Default: `CAUTHY_SYSTEM`. */
-    system?: string;
-    roles: PolicyRole[];
-    /** Cauthy's address. Default: `CAUTHY_ISSUER`. */
-    issuer?: string;
-    /** The workspace's slug. Default: `CAUTHY_TENANT`. */
-    tenant?: string;
-    /** A personal access token with `organizations:manage`. Default: `CAUTHY_TOKEN`. */
-    token?: string;
-    fetch?: typeof fetch;
-}
-/**
- * Gives Cauthy a system's catalog of roles, replacing the one it has. It is
- * the way to load a first catalog from what a system already had; from then on
- * the catalog is Cauthy's, edited in its dashboard, and pushing again would
- * overwrite what was edited there.
- */
-declare function pushPolicy(o: PushPolicyOptions): Promise<void>;
-
 /** How an application is set up to sign its people in with Cauthy. */
 interface CauthyOptions {
     /** Cauthy's public address, e.g. `https://id.example.com`. Default: `CAUTHY_ISSUER`. */
@@ -123,7 +16,7 @@ interface CauthyOptions {
     secret?: string;
     /**
      * The system this application is, as its organizations are filed under in
-     * Cauthy (`"pondari"`). When set, a session's organizations are that
+     * Cauthy (`"acme-crm"`). When set, a session's organizations are that
      * system's. Default: `CAUTHY_SYSTEM`.
      */
     system?: string;
@@ -220,6 +113,54 @@ interface SessionOrganization {
     permissions?: string[];
     /** What the person is denied here, whatever else allows it. */
     denied?: string[];
+    /**
+     * Permissions that hold only when their condition does (an amount under a
+     * limit, the person's own records…). They are in neither list above: `can`
+     * answers no for them, and `auth.check` asks Cauthy. Present, maybe empty,
+     * whenever `permissions` is.
+     */
+    conditional?: ConditionalPermission[];
+}
+/** A permission with a condition: Cauthy decides it per question (`auth.check`). */
+interface ConditionalPermission {
+    resource: string;
+    action: string;
+    effect: 'allow' | 'deny';
+}
+/** What to ask Cauthy about: an action on a resource, with what the conditions read of it. */
+interface CheckQuestion {
+    resource: string;
+    action: string;
+    /** What a condition reads as `resource.attrs`: `{ amount: 500 }`. */
+    attributes?: Record<string, unknown>;
+    /** The record's id, as a condition reads it (`resource.id`). */
+    resourceId?: string;
+    /** Whose the record is (`resource.owner_id`): `resource.owner_id == subject.id`. */
+    ownerId?: string;
+}
+/** An organization, by its id or as the session has it. */
+type OrganizationRef = string | {
+    id: string;
+};
+/** The rule that decided a check. */
+interface CheckRule {
+    /** A permission of the person's role, or an exception given to the person. */
+    source: 'role' | 'exception';
+    /** The role, when `source` is `role`. */
+    role?: string;
+    kind: string;
+    resource: string;
+    action: string;
+    effect: 'allow' | 'deny';
+    condition?: string;
+}
+/** Cauthy's answer to a check. */
+interface CheckResult {
+    allowed: boolean;
+    /** Why, in words: "allowed by role accountant: invoices:approve". */
+    reason: string;
+    /** The rule that decided; absent when none did (nothing allows it). */
+    rule?: CheckRule;
 }
 /** A signed-in person, as the server sees them. */
 interface Session {
@@ -250,6 +191,242 @@ declare class CauthyConfigError extends Error {
     constructor(message: string);
 }
 
+/** The part of an organization that says what its member may do. */
+interface Permitted {
+    /** "resource:action" entries the person is allowed; "*" is any. Absent when the system keeps no catalog in Cauthy. */
+    permissions?: string[];
+    /** Entries the person is denied whatever else allows them. */
+    denied?: string[];
+    /** Permissions with a condition: in neither list, so `can` never counts them. Ask with `auth.check`. */
+    conditional?: ConditionalPermission[];
+}
+/**
+ * Whether the person may do an action on a resource in an organization:
+ * allowed by some entry, and denied by none. A denial wins.
+ *
+ * An organization of a system that keeps no catalog in Cauthy carries no
+ * permissions, and the answer is `false`: decide by its `role` instead.
+ *
+ * A permission with a condition (`organization.conditional`) is not in the
+ * lists, so `can` answers `false` for what only it allows: the condition reads
+ * the record at hand, which only Cauthy can weigh. Ask with `auth.check`
+ * (`organizations.check` in the browser).
+ *
+ *   if (!can(organization, 'invoicing', 'write')) return forbidden()
+ */
+declare function can(organization: Permitted | null | undefined, resource: string, action: string): boolean;
+/** Something a role may do: an action on a resource, in organizations of a kind ("*", the default, is every kind). */
+interface PolicyPermission {
+    kind?: string;
+    resource: string;
+    action: string;
+    /**
+     * When it holds, in CEL: `resource.attrs.amount <= 1000000`. A permission
+     * with one is decided by Cauthy per question (`auth.check`), never by `can`.
+     */
+    condition?: string;
+}
+/** The type of an attribute a condition may read: `list` is any JSON array. */
+type AttributeType = 'string' | 'number' | 'bool' | 'list';
+/** A resource of a system's catalog: the actions done on it and the attributes its conditions read. */
+interface CatalogResource {
+    resource: string;
+    description?: string;
+    actions: string[];
+    /** Name → type, as `resource.attrs.<name>` in a condition. */
+    attributes?: Record<string, AttributeType>;
+}
+interface PolicyRole {
+    role: string;
+    name?: string;
+    description?: string;
+    /** Roles whose permissions this one has as well. */
+    inherits?: string[];
+    permissions?: PolicyPermission[];
+}
+type PermissionShape = {
+    readonly kind?: string;
+    readonly resource: string;
+    readonly action: string;
+    readonly condition?: string;
+};
+/** A role as `definePolicy` reads it: any `PolicyRole`, kept as written. */
+type RoleShape = {
+    readonly role: string;
+    readonly name?: string;
+    readonly description?: string;
+    readonly inherits?: readonly string[];
+    readonly permissions?: readonly PermissionShape[];
+};
+/** A resource as `definePolicy` reads it: any `CatalogResource`, kept as written. */
+type ResourceShape = {
+    readonly resource: string;
+    readonly description?: string;
+    readonly actions: readonly string[];
+    readonly attributes?: {
+        readonly [name: string]: AttributeType;
+    };
+};
+type Named<S extends string> = S extends '*' ? string : S;
+type PermissionsIn<R> = R extends {
+    readonly permissions: readonly (infer P)[];
+} ? P extends {
+    readonly resource: infer Res extends string;
+    readonly action: infer Act extends string;
+} ? `${Named<Res>}:${Named<Act>}` : never : never;
+type ValueOf<T> = T extends 'string' ? string : T extends 'number' ? number : T extends 'bool' ? boolean : T extends 'list' ? unknown[] : never;
+/** What a check may say about one declared resource. */
+type QuestionAbout<E> = E extends {
+    readonly resource: infer R extends string;
+    readonly actions: readonly (infer A extends string)[];
+} ? {
+    resource: R;
+    action: A;
+    attributes?: E extends {
+        readonly attributes: infer T;
+    } ? {
+        [K in keyof T]?: ValueOf<T[K]>;
+    } : Record<string, never>;
+    resourceId?: string;
+    ownerId?: string;
+} : never;
+/**
+ * What a role of a catalog that declares its resources may name: a declared
+ * resource with one of its actions, or "*", or one of Cauthy's own powers.
+ */
+type PermissionFor<C extends readonly ResourceShape[]> = {
+    readonly kind?: string;
+    readonly condition?: string;
+} & ((C[number] extends infer E ? E extends {
+    readonly resource: infer R extends string;
+    readonly actions: readonly (infer A extends string)[];
+} ? {
+    readonly resource: R;
+    readonly action: A | '*';
+} : never : never) | {
+    readonly resource: '*';
+    readonly action: string;
+} | {
+    readonly resource: `cauthy:${string}`;
+    readonly action: string;
+});
+type RoleFor<C extends readonly ResourceShape[]> = Omit<RoleShape, 'permissions'> & {
+    readonly permissions?: readonly PermissionFor<C>[];
+};
+/** The roles a catalog names: `RoleOf<typeof policy>`. */
+type RoleOf<P> = P extends Policy<infer R, any, any> ? R : never;
+/** The "resource:action" permissions a catalog names: `PermissionOf<typeof policy>`. */
+type PermissionOf<P> = P extends Policy<any, infer X, any> ? X : never;
+/** What a check about this catalog may ask: `CheckOf<typeof policy>`. Any resource when it declares none. */
+type CheckOf<P> = P extends Policy<any, any, infer Q> ? Q : never;
+/** The fields of a question: whatever else the asker takes (the organization, the person) passes through. */
+type QuestionKeys = keyof CheckQuestion;
+interface Policy<Role extends string = string, Permission extends string = string, Question extends CheckQuestion = CheckQuestion> {
+    /** The catalog as Cauthy takes it: `pushPolicy({ roles: policy.roles })`. */
+    roles: PolicyRole[];
+    /** The resources the system declares, as Cauthy takes them; empty when it declares none. */
+    catalog: CatalogResource[];
+    /** Every role's name. */
+    roleNames: Role[];
+    /** Every permission some role has, as "resource:action". */
+    permissions: Permission[];
+    /**
+     * Whether the person may do this in the organization: `can(org, 'ledger:write')`.
+     * It reads what Cauthy sent with the session, so a catalog edited in Cauthy
+     * since this file was written is still what decides. A permission with a
+     * condition is not there: ask with `check`.
+     */
+    can(organization: Permitted | null | undefined, permission: Permission): boolean;
+    /** Whether the person's role in the organization is one of these. */
+    hasRole(organization: {
+        role: string;
+    } | null | undefined, ...roles: Role[]): boolean;
+    /**
+     * What a role may do by this catalog, with what it inherits: for showing a
+     * role, never for deciding about a person (their exceptions are not here).
+     */
+    permissionsOf(role: Role): Permission[];
+    /**
+     * Asks Cauthy, with the resource, action and attributes typed by the
+     * catalog. Give it whoever asks: the server's `auth` with the request,
+     * the browser's `organizations`, or the application's `system`.
+     *
+     *   await policy.check(auth, request, { organization, resource: 'invoices', action: 'approve', attributes: { amount: 500 } })
+     *   await policy.check(auth.system, { organizationId, userId, resource: 'invoices', action: 'read' })
+     */
+    check<I extends CheckQuestion>(asker: {
+        check(input: I): Promise<CheckResult>;
+    }, input: Omit<I, QuestionKeys> & Question): Promise<CheckResult>;
+    check<R, I extends CheckQuestion>(asker: {
+        check(request: R, input: I): Promise<CheckResult>;
+    }, request: R, input: Omit<I, QuestionKeys> & Question): Promise<CheckResult>;
+}
+/** A catalog with its resources declared, for `definePolicy`. */
+interface PolicyDefinition<C extends readonly ResourceShape[], T extends readonly RoleShape[]> {
+    catalog: C;
+    roles: T;
+}
+/** Gives a catalog of roles its types. See the top of this section. */
+declare function definePolicy<const T extends readonly RoleShape[]>(roles: T): Policy<T[number]['role'], PermissionsIn<T[number]>>;
+/** Gives a catalog of resources and roles its types: a role names only what the catalog declares. */
+declare function definePolicy<const C extends readonly ResourceShape[], const T extends readonly RoleFor<C>[]>(definition: PolicyDefinition<C, T>): Policy<T[number]['role'], PermissionsIn<T[number]>, QuestionAbout<C[number]>>;
+/** A system's policy as Cauthy has it: the resources it declares (maybe none) and its roles. */
+interface SystemPolicy {
+    catalog: CatalogResource[];
+    roles: PolicyRole[];
+}
+/**
+ * A TypeScript module that defines the catalog given, for `cauthy-auth policy
+ * --pull` to write: the application's types then come from the catalog
+ * Cauthy has. With resources declared it is `definePolicy({ catalog, roles })`;
+ * without, the list of roles alone, as it always was.
+ */
+declare function policySource(system: string, read: PolicyRole[] | {
+    catalog?: CatalogResource[];
+    roles: PolicyRole[];
+}): string;
+/** Reads a system's catalog of roles from Cauthy, with a personal access token. */
+declare function pullPolicy(o?: Omit<PushPolicyOptions, 'roles'>): Promise<PolicyRole[]>;
+/** Reads the resources a system declares (empty when it declares none), with a personal access token. */
+declare function pullCatalog(o?: Omit<PushPolicyOptions, 'roles'>): Promise<CatalogResource[]>;
+interface PushPolicyOptions {
+    /** The system whose catalog this is. Default: `CAUTHY_SYSTEM`. */
+    system?: string;
+    roles: PolicyRole[];
+    /**
+     * The resources the system declares. Given, they are sent before the roles,
+     * which Cauthy then checks against them; left out, the catalog Cauthy has
+     * stays as it is.
+     */
+    catalog?: CatalogResource[];
+    /** Cauthy's address. Default: `CAUTHY_ISSUER`. */
+    issuer?: string;
+    /** The workspace's slug. Default: `CAUTHY_TENANT`. */
+    tenant?: string;
+    /**
+     * A personal access token: `organizations:manage` reads, and changing a
+     * policy or a catalog takes `systems:policy`. Default: `CAUTHY_TOKEN`.
+     */
+    token?: string;
+    fetch?: typeof fetch;
+}
+/**
+ * Gives Cauthy a system's catalog of roles, replacing the one it has. It is
+ * the way to load a first catalog from what a system already had; from then on
+ * the catalog is Cauthy's, edited in its dashboard, and pushing again would
+ * overwrite what was edited there. With `catalog` the declared resources go
+ * first: the roles are checked against them.
+ */
+declare function pushPolicy(o: PushPolicyOptions): Promise<void>;
+/**
+ * Gives Cauthy the resources a system declares, replacing the ones it has.
+ * Cauthy refuses (`catalog_in_use`) to drop a resource or an action the
+ * policy still names.
+ */
+declare function pushCatalog(o: Omit<PushPolicyOptions, 'roles' | 'catalog'> & {
+    resources: CatalogResource[];
+}): Promise<CatalogResource[]>;
+
 /** The key an application signs its assertions with. */
 interface SystemKey {
     /** The private key: PKCS#8 PEM, or a JWK (as an object or its JSON). RSA, for RS256. */
@@ -269,6 +446,8 @@ interface SystemOptions {
      * Default: `CAUTHY_SYSTEM_KEY` (the private key) and `CAUTHY_SYSTEM_KEY_ID`.
      */
     key?: SystemKey;
+    /** The application's system, which `check` asks about. Default: `CAUTHY_SYSTEM`. */
+    system?: string;
     fetch?: typeof fetch;
 }
 /** Cauthy refused a request of the application's own. */
@@ -373,6 +552,25 @@ interface CauthySystem {
     policy: {
         get(system: string): Promise<PolicyRole[]>;
     };
+    /**
+     * The resources one of the application's systems declares, with their
+     * actions and the attributes conditions read; empty when it declares none.
+     */
+    catalog: {
+        get(system: string): Promise<CatalogResource[]>;
+        /** Replaces them. Cauthy refuses (`catalog_in_use`) to drop one the policy still names. */
+        set(system: string, resources: CatalogResource[]): Promise<CatalogResource[]>;
+    };
+    /**
+     * Asks Cauthy whether a member of one of the system's organizations may do
+     * an action on a resource, conditions weighed. A person who is not a member
+     * is a no; an organization of another system throws (`organization_not_found`).
+     */
+    check(question: CheckQuestion & {
+        organizationId: string;
+        userId: string;
+        system?: string;
+    }): Promise<CheckResult>;
     /** The public half of `key`, to serve at the address Cauthy was given (`jwks_uri`). Empty with a secret. */
     publicJwks(): Promise<{
         keys: JWK[];
@@ -380,4 +578,4 @@ interface CauthySystem {
 }
 declare function createSystem(given?: SystemOptions): CauthySystem;
 
-export { CauthyApiError as C, type JsonValue as J, type NewMember as N, type Organization as O, type PermissionOf as P, type RoleOf as R, type Session as S, CauthyConfigError as a, type CauthyOptions as b, type CauthySystem as c, type OrganizationMember as d, type Permitted as e, type Policy as f, type PolicyPermission as g, type PolicyRole as h, type PublicSession as i, type PushPolicyOptions as j, type SessionOrganization as k, type SessionStatus as l, type SessionUser as m, type SystemKey as n, type SystemOptions as o, can as p, createSystem as q, definePolicy as r, policySource as s, pullPolicy as t, pushPolicy as u };
+export { type AttributeType as A, definePolicy as B, type CatalogResource as C, policySource as D, pullCatalog as E, pullPolicy as F, pushCatalog as G, pushPolicy as H, type JsonValue as J, type NewMember as N, type Organization as O, type PermissionOf as P, type RoleOf as R, type Session as S, CauthyApiError as a, CauthyConfigError as b, type CauthyOptions as c, type CauthySystem as d, type CheckOf as e, type CheckQuestion as f, type CheckResult as g, type CheckRule as h, type ConditionalPermission as i, type OrganizationMember as j, type OrganizationRef as k, type Permitted as l, type Policy as m, type PolicyDefinition as n, type PolicyPermission as o, type PolicyRole as p, type PublicSession as q, type PushPolicyOptions as r, type SessionOrganization as s, type SessionStatus as t, type SessionUser as u, type SystemKey as v, type SystemOptions as w, type SystemPolicy as x, can as y, createSystem as z };

package/dist/vue.d.mts

@@ -1,8 +1,8 @@
 import { ShallowRef, Plugin } from 'vue';
 import { SessionStore, SessionState, SessionStoreOptions, AuthClient } from './client.mjs';
 export { Account, AccountSession, AuthError, AuthMethods, AuthResult, Passkey, PasskeyKind, SSOConnection } from './client.mjs';
-import { i as PublicSession } from './system-CVBW_AV8.mjs';
-export { P as PermissionOf, f as Policy, R as RoleOf, k as SessionOrganization, m as SessionUser, p as can, r as definePolicy } from './system-CVBW_AV8.mjs';
+import { q as PublicSession } from './system-0mHrdAgO.mjs';
+export { P as PermissionOf, m as Policy, R as RoleOf, s as SessionOrganization, u as SessionUser, y as can, B as definePolicy } from './system-0mHrdAgO.mjs';
 import './theme.mjs';
 import './validate-sEXG82po.mjs';
 import 'jose';

package/dist/vue.d.ts

@@ -1,8 +1,8 @@
 import { ShallowRef, Plugin } from 'vue';
 import { SessionStore, SessionState, SessionStoreOptions, AuthClient } from './client.js';
 export { Account, AccountSession, AuthError, AuthMethods, AuthResult, Passkey, PasskeyKind, SSOConnection } from './client.js';
-import { i as PublicSession } from './system-Bn8uckvQ.js';
-export { P as PermissionOf, f as Policy, R as RoleOf, k as SessionOrganization, m as SessionUser, p as can, r as definePolicy } from './system-Bn8uckvQ.js';
+import { q as PublicSession } from './system-BIYbS7h2.js';
+export { P as PermissionOf, m as Policy, R as RoleOf, s as SessionOrganization, u as SessionUser, y as can, B as definePolicy } from './system-BIYbS7h2.js';
 import './theme.js';
 import './validate-sEXG82po.js';
 import 'jose';

package/dist/vue.js

@@ -285,6 +285,12 @@ function checkOrganization(value, required = false) {
   if (v.length > MAX_ORGANIZATION) return { field: "organization", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
   return null;
 }
+function checkOrganizationName(value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return { field: "name", code: "required", message: "Enter the organization's name." };
+  if (v.length > MAX_ORGANIZATION) return { field: "name", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
+  return null;
+}
 function checkCode(value) {
   const v = typeof value === "string" ? value.trim() : "";
   if (v === "") return { field: "code", code: "required", message: "Enter the code." };
@@ -537,7 +543,23 @@ function createAuthClient(options = {}) {
       add: (id, f) => post("/me/organizations/members/add", { organizationId: id, email: f.email, role: f.role, name: f.name ?? "", locale: f.locale ?? "" }, checkEmail(f.email)),
       setRole: (id, userId, role) => post("/me/organizations/members/role", { organizationId: id, userId, role }, null),
       remove: (id, userId) => post("/me/organizations/members/remove", { organizationId: id, userId }, null),
-      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null)
+      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null),
+      rename: (id, name) => post("/me/organizations/rename", { organizationId: id, name }, checkOrganizationName(name)),
+      archive: (id) => post("/me/organizations/archive", { organizationId: id }, null),
+      delete: (id) => post("/me/organizations/delete", { organizationId: id }, null),
+      async check(q) {
+        const organizationId = typeof q.organization === "string" ? q.organization : q.organization?.id ?? "";
+        const r = await post("/me/organizations/check", {
+          organizationId,
+          resource: q.resource,
+          action: q.action,
+          ...q.attributes !== void 0 ? { attributes: q.attributes } : {},
+          ...q.resourceId !== void 0 ? { resourceId: q.resourceId } : {},
+          ...q.ownerId !== void 0 ? { ownerId: q.ownerId } : {}
+        }, null);
+        if (!r.ok) return { allowed: false, reason: r.error.message, error: r.error };
+        return { allowed: r.allowed === true, reason: String(r.reason ?? ""), ...r.rule ? { rule: r.rule } : {} };
+      }
     },
     account: {
       async get() {
@@ -741,7 +763,9 @@ function can(organization, resource, action) {
   if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false;
   return organization.permissions.some((p) => matches(p, resource, action));
 }
-function definePolicy(roles) {
+function definePolicy(given) {
+  const roles = Array.isArray(given) ? given : given.roles;
+  const resources = Array.isArray(given) ? [] : given.catalog ?? [];
   const entry = (p) => `${p.resource}:${p.action}`;
   const byName = new Map(roles.map((r) => [r.role, r]));
   const split = (permission) => {
@@ -756,6 +780,12 @@ function definePolicy(roles) {
       ...r.inherits ? { inherits: [...r.inherits] } : {},
       ...r.permissions ? { permissions: r.permissions.map((p) => ({ ...p })) } : {}
     })),
+    catalog: resources.map((c) => ({
+      resource: c.resource,
+      ...c.description !== void 0 ? { description: c.description } : {},
+      actions: [...c.actions],
+      ...c.attributes ? { attributes: { ...c.attributes } } : {}
+    })),
     roleNames: roles.map((r) => r.role),
     permissions: [...new Set(roles.flatMap((r) => (r.permissions ?? []).map(entry)))],
     can(organization, permission) {
@@ -777,6 +807,11 @@ function definePolicy(roles) {
       };
       walk(role);
       return [...out];
+    },
+    // The types did the work; this only hands the question on, as a method of
+    // the asker so it keeps its `this`.
+    check(asker, ...args) {
+      return asker.check(...args);
     }
   };
 }