cauthy-auth 0.28.1 → 0.31.0

package/dist/index.mjs

@@ -54,9 +54,6 @@ async function unseal(sealed, key) {
   }
 }
 
-// src/system.ts
-import { exportJWK, importJWK, importPKCS8, SignJWT } from "jose";
-
 // src/url.ts
 function withoutTrailingSlashes(s) {
   let end = s.length;
@@ -64,6 +61,218 @@ function withoutTrailingSlashes(s) {
   return s.slice(0, end);
 }
 
+// src/permissions.ts
+function matches(entry, resource, action) {
+  const i = entry.lastIndexOf(":");
+  if (i < 0) return false;
+  const r = entry.slice(0, i);
+  const a = entry.slice(i + 1);
+  return (r === "*" || r === resource) && (a === "*" || a === action);
+}
+function can(organization, resource, action) {
+  if (!organization?.permissions) return false;
+  if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false;
+  return organization.permissions.some((p) => matches(p, resource, action));
+}
+function definePolicy(given) {
+  const roles = Array.isArray(given) ? given : given.roles;
+  const resources = Array.isArray(given) ? [] : given.catalog ?? [];
+  const entry = (p) => `${p.resource}:${p.action}`;
+  const byName = new Map(roles.map((r) => [r.role, r]));
+  const split = (permission) => {
+    const i = permission.lastIndexOf(":");
+    return i < 0 ? [permission, ""] : [permission.slice(0, i), permission.slice(i + 1)];
+  };
+  return {
+    roles: roles.map((r) => ({
+      role: r.role,
+      ...r.name !== void 0 ? { name: r.name } : {},
+      ...r.description !== void 0 ? { description: r.description } : {},
+      ...r.inherits ? { inherits: [...r.inherits] } : {},
+      ...r.permissions ? { permissions: r.permissions.map((p) => ({ ...p })) } : {}
+    })),
+    catalog: resources.map((c) => ({
+      resource: c.resource,
+      ...c.description !== void 0 ? { description: c.description } : {},
+      actions: [...c.actions],
+      ...c.attributes ? { attributes: { ...c.attributes } } : {}
+    })),
+    roleNames: roles.map((r) => r.role),
+    permissions: [...new Set(roles.flatMap((r) => (r.permissions ?? []).map(entry)))],
+    can(organization, permission) {
+      const [resource, action] = split(permission);
+      return can(organization, resource, action);
+    },
+    hasRole(organization, ...wanted) {
+      return organization != null && wanted.includes(organization.role);
+    },
+    permissionsOf(role) {
+      const seen = /* @__PURE__ */ new Set();
+      const out2 = /* @__PURE__ */ new Set();
+      const walk = (name) => {
+        if (seen.has(name)) return;
+        seen.add(name);
+        const r = byName.get(name);
+        for (const p of r?.permissions ?? []) out2.add(entry(p));
+        for (const parent of r?.inherits ?? []) walk(parent);
+      };
+      walk(role);
+      return [...out2];
+    },
+    // The types did the work; this only hands the question on, as a method of
+    // the asker so it keeps its `this`.
+    check(asker, ...args) {
+      return asker.check(...args);
+    }
+  };
+}
+var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+function policySource(system, read) {
+  const roles = Array.isArray(read) ? read : read.roles;
+  const catalog = Array.isArray(read) ? [] : read.catalog ?? [];
+  const text = (v) => JSON.stringify(v);
+  const key = (k) => IDENT.test(k) ? k : text(k);
+  const one = (r, pad) => {
+    const parts = [`role: ${text(r.role)}`];
+    if (r.name) parts.push(`name: ${text(r.name)}`);
+    if (r.description) parts.push(`description: ${text(r.description)}`);
+    if (r.inherits?.length) parts.push(`inherits: [${r.inherits.map(text).join(", ")}]`);
+    if (r.permissions?.length) {
+      const list = r.permissions.map((p) => `${pad}      { ${[
+        ...p.kind && p.kind !== "*" ? [`${key("kind")}: ${text(p.kind)}`] : [],
+        `resource: ${text(p.resource)}`,
+        `action: ${text(p.action)}`,
+        ...p.condition ? [`condition: ${text(p.condition)}`] : []
+      ].join(", ")} },`);
+      parts.push(`permissions: [
+${list.join("\n")}
+${pad}    ]`);
+    }
+    return `${pad}  {
+${pad}    ${parts.join(`,
+${pad}    `)},
+${pad}  },`;
+  };
+  const resource = (c) => {
+    const parts = [`resource: ${text(c.resource)}`];
+    if (c.description) parts.push(`description: ${text(c.description)}`);
+    parts.push(`actions: [${c.actions.map(text).join(", ")}]`);
+    const attrs = Object.entries(c.attributes ?? {});
+    if (attrs.length) parts.push(`attributes: { ${attrs.map(([k, v]) => `${key(k)}: ${text(v)}`).join(", ")} }`);
+    return `    { ${parts.join(", ")} },`;
+  };
+  const head = `// The catalog of roles of ${text(system)}, as Cauthy has it.
+// Written by \`cauthy-auth policy --pull\`: run it again after the catalog
+// changes, and do not edit this file by hand.
+`;
+  if (catalog.length === 0) {
+    return `${head}
+import { definePolicy, type PermissionOf, type RoleOf } from 'cauthy-auth'
+
+export const policy = definePolicy([
+${roles.map((r) => one(r, "")).join("\n")}
+])
+
+export const { can, hasRole } = policy
+export type Role = RoleOf<typeof policy>
+export type Permission = PermissionOf<typeof policy>
+`;
+  }
+  return `${head}
+import { definePolicy, type CheckOf, type PermissionOf, type RoleOf } from 'cauthy-auth'
+
+export const policy = definePolicy({
+  catalog: [
+${catalog.map(resource).join("\n")}
+  ],
+  roles: [
+${roles.map((r) => one(r, "  ")).join("\n")}
+  ],
+})
+
+export const { can, hasRole } = policy
+export type Role = RoleOf<typeof policy>
+export type Permission = PermissionOf<typeof policy>
+/** What a check may ask: \`policy.check(auth, request, { organization, ...question })\`. */
+export type Check = CheckOf<typeof policy>
+`;
+}
+function reach(o, doing) {
+  const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const r = {
+    issuer: withoutTrailingSlashes(o.issuer ?? env4("CAUTHY_ISSUER") ?? ""),
+    system: o.system ?? env4("CAUTHY_SYSTEM") ?? "",
+    tenant: o.tenant ?? env4("CAUTHY_TENANT") ?? "",
+    token: o.token ?? env4("CAUTHY_TOKEN") ?? ""
+  };
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: r.issuer, CAUTHY_SYSTEM: r.system, CAUTHY_TENANT: r.tenant, CAUTHY_TOKEN: r.token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to ${doing}`);
+  }
+  return { ...r, fetch: o.fetch ?? fetch };
+}
+async function systemCall(r, method, what, body) {
+  const res = await r.fetch(`${r.issuer}/v1/systems/${encodeURIComponent(r.system)}/${what}`, {
+    ...method === "PUT" ? { method } : {},
+    headers: {
+      authorization: `Bearer ${r.token}`,
+      "x-tenant-key": r.tenant,
+      ...body === void 0 ? { accept: "application/json" } : { "content-type": "application/json" }
+    },
+    ...body === void 0 ? {} : { body: JSON.stringify(body) }
+  });
+  const answer = await res.json().catch(() => null);
+  if (!res.ok) {
+    const verb = method === "GET" ? `refused to give the ${what}` : `refused the ${what}`;
+    throw new Error(`cauthy-auth: Cauthy ${verb} (${res.status}): ${answer?.errors?.[0]?.message ?? res.statusText}`);
+  }
+  return answer?.data;
+}
+async function pullPolicy(o = {}) {
+  const data = await systemCall(reach(o, "read a policy"), "GET", "policy");
+  return data?.roles ?? [];
+}
+async function pullCatalog(o = {}) {
+  const data = await systemCall(reach(o, "read a catalog"), "GET", "catalog");
+  return data?.resources ?? [];
+}
+async function pushPolicy(o) {
+  const r = reach(o, "push a policy");
+  if (o.catalog !== void 0) await systemCall(r, "PUT", "catalog", { resources: o.catalog });
+  await systemCall(r, "PUT", "policy", { roles: o.roles });
+}
+async function pushCatalog(o) {
+  const data = await systemCall(reach(o, "push a catalog"), "PUT", "catalog", { resources: o.resources });
+  return data?.resources ?? [];
+}
+function checkWire(q) {
+  return {
+    resource: q.resource,
+    action: q.action,
+    ...q.resourceId !== void 0 ? { resource_id: q.resourceId } : {},
+    ...q.ownerId !== void 0 ? { owner_id: q.ownerId } : {},
+    ...q.attributes !== void 0 ? { attributes: q.attributes } : {}
+  };
+}
+function checkResultOf(d) {
+  const r = d?.rule;
+  const rule = r && typeof r === "object" ? {
+    source: r.source === "exception" ? "exception" : "role",
+    ...r.role ? { role: String(r.role) } : {},
+    kind: String(r.kind ?? "*"),
+    resource: String(r.resource ?? ""),
+    action: String(r.action ?? ""),
+    effect: r.effect === "allow" ? "allow" : "deny",
+    ...r.condition ? { condition: String(r.condition) } : {}
+  } : void 0;
+  return { allowed: d?.allowed === true, reason: String(d?.reason ?? ""), ...rule ? { rule } : {} };
+}
+function organizationIdOf(o) {
+  return typeof o === "string" ? o : typeof o?.id === "string" ? o.id : "";
+}
+
+// src/system.ts
+import { exportJWK, importJWK, importPKCS8, SignJWT } from "jose";
+
 // src/theme.ts
 var MAX_RADIUS = 40;
 function withoutComments(css) {
@@ -481,6 +690,9 @@ function createSystem(given = {}) {
   const clientSecret = given.clientSecret ?? env("CAUTHY_CLIENT_SECRET") ?? "";
   const envKey = env("CAUTHY_SYSTEM_KEY");
   const key = given.key ?? (envKey ? { privateKey: envKey, keyId: env("CAUTHY_SYSTEM_KEY_ID") ?? "" } : void 0);
+  const ownSystem = given.system ?? env("CAUTHY_SYSTEM") ?? "";
+  const acceptInviteUrl = given.acceptInviteUrl ?? env("CAUTHY_ACCEPT_INVITE_URL") ?? "";
+  const inviteHeaders = /^https?:\/\//.test(acceptInviteUrl) ? { "x-cauthy-client-id": clientId, "x-cauthy-link-to": acceptInviteUrl } : {};
   const doFetch = (...args) => (given.fetch ?? fetch)(...args);
   const tokenEndpoint = `${issuer}/v1/oauth/token`;
   function configured() {
@@ -523,10 +735,10 @@ function createSystem(given = {}) {
       asking = void 0;
     });
   }
-  async function call(method, path, body) {
+  async function call(method, path, body, extra = {}) {
     const send = async () => doFetch(`${issuer}${path}`, {
       method,
-      headers: { authorization: `Bearer ${await token()}`, ...body === void 0 ? {} : { "content-type": "application/json" } },
+      headers: { authorization: `Bearer ${await token()}`, ...extra, ...body === void 0 ? {} : { "content-type": "application/json" } },
       body: body === void 0 ? void 0 : JSON.stringify(body)
     });
     let res = await send();
@@ -537,7 +749,7 @@ function createSystem(given = {}) {
     if (!res.ok) await fail(res, `${method} ${path}`);
     return res.status === 204 ? void 0 : res.json();
   }
-  const data = async (method, path, body) => (await call(method, path, body))?.data;
+  const data = async (method, path, body, extra) => (await call(method, path, body, extra))?.data;
   const id = encodeURIComponent;
   return {
     token,
@@ -574,7 +786,8 @@ function createSystem(given = {}) {
         return toMember(await data(
           "POST",
           `/v1/organizations/${id(orgId)}/members`,
-          { role: m.role, user_id: m.userId, email: m.email, name: m.name, locale: m.locale, client_id: clientId }
+          { role: m.role, user_id: m.userId, email: m.email, name: m.name, locale: m.locale, client_id: clientId },
+          inviteHeaders
         ));
       },
       async setRole(orgId, userId, role) {
@@ -585,7 +798,7 @@ function createSystem(given = {}) {
       }
     },
     async invite(person) {
-      const u = await data("POST", "/v1/users", { ...person, client_id: clientId });
+      const u = await data("POST", "/v1/users", { ...person, client_id: clientId }, inviteHeaders);
       return { id: u.id, email: u.email };
     },
     theme: {
@@ -598,6 +811,19 @@ function createSystem(given = {}) {
         return (await data("GET", `/v1/systems/${id(system)}/policy`)).roles ?? [];
       }
     },
+    catalog: {
+      async get(system) {
+        return (await data("GET", `/v1/systems/${id(system)}/catalog`)).resources ?? [];
+      },
+      async set(system, resources) {
+        return (await data("PUT", `/v1/systems/${id(system)}/catalog`, { resources })).resources ?? [];
+      }
+    },
+    async check(q) {
+      const system = q.system ?? ownSystem;
+      if (system === "") throw new CauthyConfigError("name the system to check in (system, or CAUTHY_SYSTEM)");
+      return checkResultOf(await data("POST", `/v1/systems/${id(system)}/check`, { organization_id: q.organizationId, user_id: q.userId, ...checkWire(q) }));
+    },
     async publicJwks() {
       if (!key) return { keys: [] };
       const { kty, n, e } = asJwk(key) ?? await exportJWK(await signingKey());
@@ -745,6 +971,12 @@ function checkOrganization(value, required = false) {
   if (v.length > MAX_ORGANIZATION) return { field: "organization", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
   return null;
 }
+function checkOrganizationName(value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return { field: "name", code: "required", message: "Enter the organization's name." };
+  if (v.length > MAX_ORGANIZATION) return { field: "name", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
+  return null;
+}
 function checkCode(value) {
   const v = typeof value === "string" ? value.trim() : "";
   if (v === "") return { field: "code", code: "required", message: "Enter the code." };
@@ -876,6 +1108,9 @@ function redirect(location, cookies = []) {
   for (const c of cookies) h.append("set-cookie", c);
   return new Response(null, { status: 302, headers: h });
 }
+function conditionalOf(c) {
+  return { resource: String(c?.resource ?? ""), action: String(c?.action ?? ""), effect: c?.effect === "deny" ? "deny" : "allow" };
+}
 function createCauthy(given = {}) {
   const issuer = withoutTrailingSlashes(given.issuer ?? env2("CAUTHY_ISSUER") ?? "");
   const clientId = given.clientId ?? env2("CAUTHY_CLIENT_ID") ?? "";
@@ -898,13 +1133,16 @@ function createCauthy(given = {}) {
   const againCookie = `${cookieName}_again`;
   const stepCookie = `${cookieName}_step`;
   const doFetch = (...args) => (given.fetch ?? fetch)(...args);
+  const iconOf = iconFor(issuer);
   const key = keyOf(secret);
   const pages = {
     signIn: given.pages?.signIn ? localPath(given.pages.signIn, "/") : void 0,
     resetPassword: given.pages?.resetPassword ? localPath(given.pages.resetPassword, "/") : void 0,
-    verifyEmail: given.pages?.verifyEmail ? localPath(given.pages.verifyEmail, "/") : void 0
+    verifyEmail: given.pages?.verifyEmail ? localPath(given.pages.verifyEmail, "/") : void 0,
+    acceptInvite: given.pages?.acceptInvite ? localPath(given.pages.acceptInvite, "/") : void 0
   };
-  const ownSystem = createSystem({ issuer, clientId, clientSecret, key: given.systemKey, fetch: given.fetch });
+  const acceptInviteUrl = baseURL && pages.acceptInvite ? `${withoutTrailingSlashes(baseURL)}${pages.acceptInvite}` : void 0;
+  const ownSystem = createSystem({ issuer, clientId, clientSecret, key: given.systemKey, system: system || void 0, acceptInviteUrl, fetch: given.fetch });
   const originOf = (request) => {
     if (baseURL) return withoutTrailingSlashes(baseURL);
     const url = new URL(request.url);
@@ -1039,13 +1277,35 @@ function createCauthy(given = {}) {
         role: String(o.role ?? ""),
         metadata: o.metadata ?? {},
         ...o.external_id ? { externalId: String(o.external_id) } : {},
-        ...Array.isArray(o.permissions) ? { permissions: o.permissions.map(String), denied: Array.isArray(o.denied) ? o.denied.map(String) : [] } : {}
+        ...Array.isArray(o.permissions) ? { permissions: o.permissions.map(String), denied: Array.isArray(o.denied) ? o.denied.map(String) : [], conditional: Array.isArray(o.conditional) ? o.conditional.map(conditionalOf) : [] } : {}
       })
     );
     if (orgCache.size > 5e3) orgCache.clear();
     orgCache.set(session.accessToken, { at: Date.now(), value });
     return value;
   }
+  async function decide(token2, question) {
+    const org = organizationIdOf(question.organization);
+    if (org === "") return { allowed: false, reason: "no organization named" };
+    const res = await doFetch(`${issuer}/v1/oauth/organizations/${encodeURIComponent(org)}/check`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token2}`, "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify(checkWire(question))
+    }).catch(() => null);
+    if (res === null) throw new CauthyApiError(503, "unavailable", "Cauthy could not be reached to check a permission");
+    const body2 = await res.json().catch(() => null);
+    if (res.ok) return checkResultOf(body2?.data);
+    const first = body2?.errors?.[0];
+    if (res.status === 401 || res.status === 403 || res.status === 404) {
+      return { allowed: false, reason: first?.message ?? (res.status === 401 ? "not signed in" : res.status === 404 ? "not a member of the organization" : "refused") };
+    }
+    throw new CauthyApiError(res.status, first?.code ?? "error", `Cauthy refused to check a permission (${res.status}): ${first?.message ?? res.statusText}`);
+  }
+  async function check(who, question) {
+    const session = "accessToken" in who ? who : await getSession(who);
+    if (!session) return { allowed: false, reason: "not signed in" };
+    return decide(session.accessToken, question);
+  }
   const forgetting = (fn) => async (...args) => {
     const out2 = await fn(...args);
     orgCache.clear();
@@ -1178,7 +1438,15 @@ function createCauthy(given = {}) {
     name: String(d?.name ?? ""),
     kind: String(d?.kind ?? ""),
     role: String(d?.role ?? ""),
-    can: { readMembers: d?.can?.read_members === true, manageMembers: d?.can?.manage_members === true }
+    // A Cauthy from before a power says nothing of it: then it is not given.
+    can: {
+      readMembers: d?.can?.read_members === true,
+      manageMembers: d?.can?.manage_members === true,
+      removeMembers: d?.can?.remove_members === true,
+      update: d?.can?.update === true,
+      archive: d?.can?.archive === true,
+      delete: d?.can?.delete === true
+    }
   });
   const orgMemberOf = (d) => ({
     userId: String(d?.user_id ?? ""),
@@ -1301,6 +1569,14 @@ function createCauthy(given = {}) {
     for (const c of [...await write(request, s, readCookies(request.headers.get("cookie"))), ...extra]) h.append("set-cookie", c);
     return json({ status: "signed_in", session: await toPublic(toSession(s)), ...more }, 200, h);
   }
+  async function loggedIn(request, data) {
+    if (data?.mfa_required === true) {
+      const step = { kind: "mfa", token: String(data.mfa_token ?? ""), returnTo: afterSignIn };
+      const how = data.mfa_method === "email" ? { method: "email" } : {};
+      return json({ status: "mfa_required", ...how }, 200, new Headers({ "set-cookie": writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS)) }));
+    }
+    return signedIn(request, data);
+  }
   let lookCache = null;
   let policyCache = null;
   const keepPolicy = (settings) => {
@@ -1371,7 +1647,12 @@ function createCauthy(given = {}) {
       "/me/organizations/members/add",
       "/me/organizations/members/role",
       "/me/organizations/members/remove",
-      "/me/organizations/members/invite"
+      "/me/organizations/members/invite",
+      "/me/organizations/rename",
+      "/me/organizations/archive",
+      "/me/organizations/delete",
+      "/invitation",
+      "/invitation/accept"
     ].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/") || route.startsWith("/me/upgrade/social/") || route === "/sign-in/sso" || route === "/sign-in/sso/discover" || route === "/sso/callback";
     if (!own) return null;
     if (tenant === "") {
@@ -1393,17 +1674,21 @@ function createCauthy(given = {}) {
       ]);
       const list = Array.isArray(providers.data) ? providers.data : [];
       const password = keepPolicy(settings);
-      const here = place.data?.here === true;
+      const passkeys = settings.data?.allow_passkeys !== false;
+      const here = passkeys && place.data?.here === true;
       return json({
-        providers: list.map((p) => ({ id: String(p.provider ?? p.id ?? ""), name: String(p.label ?? p.name ?? p.provider ?? "") })).filter((p) => p.id !== ""),
+        providers: list.map((p) => ({ id: String(p.provider ?? p.id ?? ""), name: String(p.label ?? p.name ?? p.provider ?? ""), ...iconOf(p) })).filter((p) => p.id !== ""),
+        // Whether the workspace signs people in with a password at all. A
+        // Cauthy from before the setting says nothing of it: then it does.
+        passwordSignIn: settings.data?.allow_password !== false,
         signUp: settings.data?.allow_signup !== false,
         // The application's system makes an organization per sign-up: the form asks the company's name.
         ...settings.data?.signup?.organization?.ask === true ? { organization: { ask: true, required: settings.data.signup.organization.required === true } } : {},
         // A sign-in link needs a page of the application to open.
         magicLink: settings.data?.allow_magic_link === true && pages.signIn !== void 0,
-        passkey: place.error ? true : here || place.data?.on_cauthy === true,
+        passkey: passkeys && (place.error ? true : here || place.data?.on_cauthy === true),
         passkeyHere: here,
-        passkeyOnCauthy: place.error ? true : place.data?.on_cauthy === true,
+        passkeyOnCauthy: passkeys && (place.error ? true : place.data?.on_cauthy === true),
         // A company's sign-in, found by the person's work address.
         sso: Array.isArray(sso.data) && sso.data.some((c) => c?.discoverable === true),
         // The terms a sign-up accepts and the consents it answers, when the workspace asks any.
@@ -1413,6 +1698,14 @@ function createCauthy(given = {}) {
         ...password ? { password } : {}
       });
     }
+    if (route === "/invitation" && !post) {
+      const token2 = (url.searchParams.get("token") ?? "").trim();
+      if (token2 === "" || token2.length > 512) return problem(422, "invalid_token", "This invitation is not valid, or it has expired.");
+      const res = await ask(request, "GET", `/v1/auth/invitation?token=${encodeURIComponent(token2)}`);
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      const organization = typeof res.data?.organization === "string" && res.data.organization !== "" ? { organization: res.data.organization } : {};
+      return json({ status: "ok", invitation: { email: String(res.data?.email ?? ""), workspace: String(res.data?.workspace ?? ""), ...organization } });
+    }
     if (route === "/sign-in/sso" && !post) {
       const returnTo = localPath(url.searchParams.get("return_to"), afterSignIn);
       const failed2 = (code) => redirect(`${returnTo}${returnTo.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code)}`);
@@ -1642,12 +1935,7 @@ function createCauthy(given = {}) {
       if (bad) return invalid(bad);
       const res = await ask(request, "POST", "/v1/auth/login", { email: String(b.email).trim(), password: b.password });
       if (res.error) return problem(res.status, res.error.code, res.error.message);
-      if (res.data?.mfa_required === true) {
-        const step = { kind: "mfa", token: String(res.data.mfa_token ?? ""), returnTo: afterSignIn };
-        const how = res.data.mfa_method === "email" ? { method: "email" } : {};
-        return json({ status: "mfa_required", ...how }, 200, new Headers({ "set-cookie": writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS)) }));
-      }
-      return signedIn(request, res.data);
+      return loggedIn(request, res.data);
     }
     if (route === "/sign-in/mfa") {
       const bad = checkCode(b.code);
@@ -1842,6 +2130,23 @@ function createCauthy(given = {}) {
         if (res.error) return refused(res, res.error.code === "weak_password" ? "password" : "email");
         return signedIn(request, res.data);
       }
+      if (route === "/me/organizations/rename" || route === "/me/organizations/archive" || route === "/me/organizations/delete") {
+        const org = typeof b.organizationId === "string" ? b.organizationId : "";
+        if (!UUID.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
+        const path = `/v1/auth/me/organizations/${org}`;
+        if (route === "/me/organizations/rename") {
+          const bad = checkOrganizationName(b.name);
+          if (bad) return invalid(bad);
+          const res2 = await as(path, { name: String(b.name).trim() }, "PATCH");
+          if (res2.error) return refused(res2, res2.error.code === "validation_error" ? "name" : void 0);
+          orgCache.delete(mine.token);
+          return json({ status: "renamed", organization: seatOf(res2.data) }, 200, mine.headers);
+        }
+        const res = route === "/me/organizations/archive" ? await as(`${path}/archive`) : await as(path, void 0, "DELETE");
+        if (res.error) return refused(res);
+        orgCache.delete(mine.token);
+        return json({ status: route === "/me/organizations/archive" ? "archived" : "deleted", organizationId: org }, 200, mine.headers);
+      }
       if (route.startsWith("/me/organizations/members/")) {
         const org = typeof b.organizationId === "string" ? b.organizationId : "";
         if (!UUID.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
@@ -1851,13 +2156,13 @@ function createCauthy(given = {}) {
           if (bad) return invalid(bad);
           const role = typeof b.role === "string" ? b.role : "";
           if (role === "") return problem(400, "invalid_role", "Choose a role.", "role", mine.headers);
-          const res = await as(base, {
+          const res = await ask(request, "POST", base, {
             email: String(b.email).trim(),
             role,
             name: typeof b.name === "string" ? b.name.trim() : "",
             client_id: clientId,
             ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {}
-          });
+          }, pages.acceptInvite, mine.token);
           if (res.error) return refused(res, res.error.code === "unknown_role" ? "role" : "email");
           return json({ status: "added", member: orgMemberOf(res.data) }, 200, mine.headers);
         }
@@ -1877,7 +2182,7 @@ function createCauthy(given = {}) {
           return json({ status: "removed", userId: user }, 200, mine.headers);
         }
         if (route === "/me/organizations/members/invite") {
-          const res = await as(`${base}/${user}/invite`, { client_id: clientId, ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {} });
+          const res = await ask(request, "POST", `${base}/${user}/invite`, { client_id: clientId, ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {} }, pages.acceptInvite, mine.token);
           if (res.error) return refused(res);
           return json({ status: "sent", userId: user }, 200, mine.headers);
         }
@@ -1916,6 +2221,14 @@ function createCauthy(given = {}) {
       if (res.data?.access_token) return signedIn(request, res.data);
       return json({ status: "verified" });
     }
+    if (route === "/invitation/accept") {
+      if (!isToken(b.token)) return problem(422, "invalid_token", "This invitation is not valid, or it has expired.");
+      const bad = await newPasswordProblem(request, b.password);
+      if (bad) return invalid(bad);
+      const res = await ask(request, "POST", "/v1/auth/invitation/accept", { token: String(b.token), password: b.password });
+      if (res.error) return problem(res.status, res.error.code, res.error.message, res.error.code === "weak_password" ? "password" : void 0, void 0, res.error.reasons);
+      return loggedIn(request, res.data);
+    }
     if (route === "/sign-in/passkey/begin") {
       const email = typeof b.email === "string" && checkEmail(b.email) === null ? b.email.trim() : "";
       const res = await ask(request, "POST", "/v1/auth/webauthn/login/begin", email !== "" ? { email } : {});
@@ -1987,6 +2300,7 @@ function createCauthy(given = {}) {
     const get = request.method === "GET" || request.method === "HEAD";
     const mine = await ownRoute(request, url, route);
     if (mine !== null) return mine;
+    if (route === "/me/organizations/check") return checkRoute(request);
     if (route === "/login" && get) return login(request, url);
     if (route === "/callback" && get) return callback(request, url);
     if (route === "/logout" && (get || request.method === "POST")) return logout(request);
@@ -2013,6 +2327,36 @@ function createCauthy(given = {}) {
     }
     return new Response("Not found", { status: 404 });
   }
+  async function checkRoute(request) {
+    if (request.method !== "POST") return new Response("Method not allowed", { status: 405, headers: { allow: "POST" } });
+    if (!ownRequest(request)) return problem(403, "cross_site", "This request did not come from this application.");
+    const b = await body(request);
+    if (b === null) return problem(400, "bad_request", "Send the question as JSON.");
+    const asker = await signedInAs(request);
+    if ("response" in asker) return asker.response;
+    const org = typeof b.organizationId === "string" ? b.organizationId : "";
+    if (!UUID.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, asker.headers);
+    const named = (v) => typeof v === "string" && v !== "" && v.length <= 200;
+    if (!named(b.resource) || !named(b.action)) return problem(400, "bad_request", "Say which resource and action.", void 0, asker.headers);
+    const attributes2 = b.attributes;
+    if (attributes2 !== void 0 && (typeof attributes2 !== "object" || attributes2 === null || Array.isArray(attributes2))) {
+      return problem(400, "bad_request", "The attributes are an object.", void 0, asker.headers);
+    }
+    try {
+      const r = await decide(asker.token, {
+        organization: org,
+        resource: b.resource,
+        action: b.action,
+        ...attributes2 !== void 0 ? { attributes: attributes2 } : {},
+        ...typeof b.resourceId === "string" ? { resourceId: b.resourceId } : {},
+        ...typeof b.ownerId === "string" ? { ownerId: b.ownerId } : {}
+      });
+      return json({ status: "decided", ...r }, 200, asker.headers);
+    } catch (e) {
+      const err = e instanceof CauthyApiError ? e : new CauthyApiError(503, "unavailable", "Cauthy could not be reached.");
+      return problem(err.status, err.code, err.message.replace(/^cauthy-auth: /, ""), void 0, asker.headers);
+    }
+  }
   async function protect(request) {
     const { value } = await read(request);
     if (value !== null && fresh(value)) return { session: toSession(value) };
@@ -2036,11 +2380,24 @@ function createCauthy(given = {}) {
     resolve: resolve2,
     protect,
     organizations,
+    check,
     toPublic,
     urls,
     options: { issuer, clientId, basePath, afterSignIn, afterSignOut, cookieName }
   };
 }
+function iconFor(issuer) {
+  return (p) => {
+    const raw = typeof p?.icon_url === "string" ? p.icon_url.trim() : "";
+    if (raw === "") return {};
+    try {
+      const url = new URL(raw.startsWith("/") && !raw.startsWith("//") ? `${issuer}${raw}` : raw);
+      return url.protocol === "https:" || url.protocol === "http:" ? { iconUrl: url.href } : {};
+    } catch {
+      return {};
+    }
+  };
+}
 function legalOf(raw) {
   const documents = Array.isArray(raw?.documents) ? raw.documents : [];
   const purposes = Array.isArray(raw?.consent_purposes) ? raw.consent_purposes : [];
@@ -2050,128 +2407,6 @@ function legalOf(raw) {
   };
 }
 
-// src/permissions.ts
-function matches(entry, resource, action) {
-  const i = entry.lastIndexOf(":");
-  if (i < 0) return false;
-  const r = entry.slice(0, i);
-  const a = entry.slice(i + 1);
-  return (r === "*" || r === resource) && (a === "*" || a === action);
-}
-function can(organization, resource, action) {
-  if (!organization?.permissions) return false;
-  if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false;
-  return organization.permissions.some((p) => matches(p, resource, action));
-}
-function definePolicy(roles) {
-  const entry = (p) => `${p.resource}:${p.action}`;
-  const byName = new Map(roles.map((r) => [r.role, r]));
-  const split = (permission) => {
-    const i = permission.lastIndexOf(":");
-    return i < 0 ? [permission, ""] : [permission.slice(0, i), permission.slice(i + 1)];
-  };
-  return {
-    roles: roles.map((r) => ({
-      role: r.role,
-      ...r.name !== void 0 ? { name: r.name } : {},
-      ...r.description !== void 0 ? { description: r.description } : {},
-      ...r.inherits ? { inherits: [...r.inherits] } : {},
-      ...r.permissions ? { permissions: r.permissions.map((p) => ({ ...p })) } : {}
-    })),
-    roleNames: roles.map((r) => r.role),
-    permissions: [...new Set(roles.flatMap((r) => (r.permissions ?? []).map(entry)))],
-    can(organization, permission) {
-      const [resource, action] = split(permission);
-      return can(organization, resource, action);
-    },
-    hasRole(organization, ...wanted) {
-      return organization != null && wanted.includes(organization.role);
-    },
-    permissionsOf(role) {
-      const seen = /* @__PURE__ */ new Set();
-      const out2 = /* @__PURE__ */ new Set();
-      const walk = (name) => {
-        if (seen.has(name)) return;
-        seen.add(name);
-        const r = byName.get(name);
-        for (const p of r?.permissions ?? []) out2.add(entry(p));
-        for (const parent of r?.inherits ?? []) walk(parent);
-      };
-      walk(role);
-      return [...out2];
-    }
-  };
-}
-var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
-function policySource(system, roles) {
-  const text = (v) => JSON.stringify(v);
-  const key = (k) => IDENT.test(k) ? k : text(k);
-  const one = (r) => {
-    const parts = [`role: ${text(r.role)}`];
-    if (r.name) parts.push(`name: ${text(r.name)}`);
-    if (r.description) parts.push(`description: ${text(r.description)}`);
-    if (r.inherits?.length) parts.push(`inherits: [${r.inherits.map(text).join(", ")}]`);
-    if (r.permissions?.length) {
-      const list = r.permissions.map((p) => `      { ${[...p.kind && p.kind !== "*" ? [`${key("kind")}: ${text(p.kind)}`] : [], `resource: ${text(p.resource)}`, `action: ${text(p.action)}`].join(", ")} },`);
-      parts.push(`permissions: [
-${list.join("\n")}
-    ]`);
-    }
-    return `  {
-    ${parts.join(",\n    ")},
-  },`;
-  };
-  return `// The catalog of roles of ${text(system)}, as Cauthy has it.
-// Written by \`cauthy-auth policy --pull\`: run it again after the catalog
-// changes, and do not edit this file by hand.
-
-import { definePolicy, type PermissionOf, type RoleOf } from 'cauthy-auth'
-
-export const policy = definePolicy([
-${roles.map(one).join("\n")}
-])
-
-export const { can, hasRole } = policy
-export type Role = RoleOf<typeof policy>
-export type Permission = PermissionOf<typeof policy>
-`;
-}
-async function pullPolicy(o = {}) {
-  const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = withoutTrailingSlashes(o.issuer ?? env4("CAUTHY_ISSUER") ?? "");
-  const system = o.system ?? env4("CAUTHY_SYSTEM") ?? "";
-  const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
-  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_SYSTEM: system, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
-    if (v === "") throw new Error(`cauthy-auth: ${name} is required to read a policy`);
-  }
-  const res = await (o.fetch ?? fetch)(`${issuer}/v1/systems/${encodeURIComponent(system)}/policy`, {
-    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, accept: "application/json" }
-  });
-  const body = await res.json().catch(() => null);
-  if (!res.ok) throw new Error(`cauthy-auth: Cauthy refused to give the policy (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
-  return body?.data?.roles ?? [];
-}
-async function pushPolicy(o) {
-  const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = withoutTrailingSlashes(o.issuer ?? env4("CAUTHY_ISSUER") ?? "");
-  const system = o.system ?? env4("CAUTHY_SYSTEM") ?? "";
-  const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
-  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_SYSTEM: system, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
-    if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a policy`);
-  }
-  const res = await (o.fetch ?? fetch)(`${issuer}/v1/systems/${encodeURIComponent(system)}/policy`, {
-    method: "PUT",
-    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
-    body: JSON.stringify({ roles: o.roles })
-  });
-  if (!res.ok) {
-    const body = await res.json().catch(() => null);
-    throw new Error(`cauthy-auth: Cauthy refused the policy (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
-  }
-}
-
 // src/connect.ts
 function sessionSecret() {
   const bytes = crypto.getRandomValues(new Uint8Array(32));
@@ -2296,7 +2531,9 @@ export {
   passwordPolicyOf,
   passwordProblems,
   policySource,
+  pullCatalog,
   pullPolicy,
+  pushCatalog,
   pushPolicy,
   pushTheme,
   themeFromStackmyth,