create-mithaq 0.0.0-stage → 0.1.1

package/template/templates/asas/src/courses/ui/no-courses.tsx

@@ -0,0 +1,13 @@
+// What the courses list draws when it holds no row, and what the board page
+// draws by path: the same file under a registered name and an inline path.
+import type { EmptyProps } from 'mithaq/admin'
+import { useKayan, useLocale } from 'mithaq/admin/react'
+
+export function NoCourses({ page }: EmptyProps) {
+  const { t } = useLocale()
+  return (
+    <p data-empty={`${useKayan().name}${page.path}`} className="text-muted-foreground text-sm">
+      {t('courses.none', 'No courses yet.')}
+    </p>
+  )
+}

package/template/templates/asas/src/courses/ui/on-offer.ts

@@ -0,0 +1,6 @@
+// The courses the portal offers: every course not archived. The portal lists
+// these alone, as its screen's `baseFilter` for the kayan, and its home counts
+// these alone. Plain data in a file of its own, so the page that counts reads it
+// without the kayan's declaration. A course with no `archived` value is not
+// archived either.
+export const onOffer = { or: [{ archived: { exists: false } }, { archived: { equals: false } }] }

package/template/templates/asas/src/courses/ui/status-cell.tsx

@@ -0,0 +1,31 @@
+// The list reads each row's latest draft, so a published course whose newest version is a draft
+// and a never-published course both arrive as `draft`. The plain read finds only courses with a
+// published copy, which tells the two apart.
+import { use } from 'react'
+import { useQuery } from '@tanstack/react-query'
+import type { CellProps, Row } from 'mithaq/admin'
+import { ListContext, useClient, useLocale, useScreen } from 'mithaq/admin/react'
+import { Badge } from '@/components/ui/badge'
+import { noValue } from '@/components/mithaq/controls.tsx'
+import { coursesOf } from '../../enrollments/ui/session-cell.tsx'
+
+const pills = {
+  draft: 'bg-muted text-muted-foreground',
+  published: 'bg-emerald-500/15 text-emerald-700 dark:text-emerald-400',
+  changed: 'bg-amber-500/15 text-amber-700 dark:text-amber-400',
+}
+const words = { draft: 'Draft', published: 'Published', changed: 'Changed' }
+
+export function StatusCell({ value, row }: CellProps) {
+  const client = useClient()
+  const { t } = useLocale()
+  const { maxLimit } = useScreen()
+  // Sorted, so the same rows in another order are the same query.
+  const ids = [...new Set((use(ListContext)?.page.docs ?? [row]).flatMap((one: Row) => (one._status === 'draft' ? [String(one.id)] : [])))].sort()
+  const { data: published, isError } = useQuery({ queryKey: ['status-cell', ids], queryFn: () => coursesOf({ client, ids, maxLimit }), enabled: ids.length > 0, staleTime: 30_000 })
+  if (value !== 'draft' && value !== 'published') return noValue
+  // Loading until the read answers, and a draft where it failed, which is what the row itself holds.
+  if (value === 'draft' && !published && !isError) return t('admin.loading', 'Loading…')
+  const status = value === 'draft' && published?.has(String(row.id)) ? 'changed' : value
+  return <Badge data-status={status} className={pills[status]}>{t(`version.${status}`, words[status])}</Badge>
+}

package/template/templates/asas/src/enrollments/enrollments.ts

@@ -0,0 +1,137 @@
+import { defaultFields, defaultOperations, folderOf } from 'mithaq'
+import { defineKayan, organization } from '../mithaq.ts'
+import { readsPast, user as actor } from '../tenant-access.ts'
+import { activity, appPage, danger, platformList, platformRecord, topPage } from '../pages.ts'
+import { user } from '../kayan/auth/user/user.ts'
+import { sessions } from '../sessions/sessions.ts'
+
+const ui = folderOf(new URL('./ui/', import.meta.url))
+const sessionCell = ui('session-cell.tsx#SessionCell')
+const enrollment = [{ section: 'enrollment', label: { en: 'Enrollment', ar: 'التسجيل' }, fields: ['session', 'student'] }] as const
+
+/**
+ * The seats an actor reads, edits and deletes, inside its active organization:
+ * every seat of its organization for an actor holding
+ * `enrollments.others` and for platform staff, its own seats alone for anyone
+ * else. That is the student, whose enrollment keys would otherwise reach every
+ * other student's seat, and a custom role a tenant writes without the key.
+ * Another's seat answers 404, as a missing row does.
+ *
+ * The id is read off the actor as an own key, and an actor carrying none reaches
+ * no seat. Every read answers from it, a session's join of its enrollments
+ * included.
+ */
+const ownSeats = ({ user }: { user: unknown }) => {
+  if (readsPast(user, 'enrollments.others')) return true
+  const actor = user && typeof user === 'object' ? (user as Record<string, unknown>) : undefined
+  const id = actor && Object.hasOwn(actor, 'id') ? actor.id : undefined
+  return typeof id === 'string' && id ? { student: { equals: id } } : false
+}
+
+export const enrollments = defineKayan({
+  name: 'enrollments',
+  access: { read: ownSeats, update: ownSeats, delete: ownSeats },
+  fields: {
+    ...defaultFields,
+    organization,
+    // Read as the session's course and its start on every screen, where a
+    // session alone is titled by its start.
+    //
+    // Both are required, so no write makes a seat for nobody or in nothing, and
+    // a session or a person that holds one is not deleted under it: a required
+    // relationship restricts.
+    session: {
+      kind: 'relationship', label: { en: 'Session', ar: 'الحصة' }, relationTo: () => sessions,
+      rules: { required: true },
+      targets: { dashboard: { cell: sessionCell }, portal: { cell: sessionCell }, platform: { cell: sessionCell } },
+    },
+    // A create that names no student enrolls the person making it: the runner's
+    // defaults step fills it from the actor, and a field with a default is one a
+    // create may leave out, at the HTTP boundary too. A role without the column's
+    // key is refused the filled value, so today only the instructor's and the
+    // administrator's API create fills it; the student reads its own seats and
+    // creates none.
+    student: {
+      kind: 'relationship', label: { en: 'Student', ar: 'الطالب' }, relationTo: () => user,
+      rules: { required: true, defaultValue: actor.id },
+    },
+    /**
+     * The field the language names as its soft-delete mark, so a student who
+     * leaves a session is a row this kayan keeps rather than one it removes: an
+     * enrollment is the record that the student was there. It is the one kayan
+     * of this template that takes the mark. Nothing points at an enrollment, so
+     * no child outlives it, and nothing refers to it through a `restrict`
+     * foreign key that a delete would have to release. Nobody supplies the
+     * mark: the runner writes it at the delete.
+     *
+     * `session` and `student` are required, so each restricts, and a session or
+     * a person a marked enrollment still names is not deleted under it.
+     */
+    deletedAt: {
+      kind: 'datetime',
+      label: { en: 'Deleted at', ar: 'تاريخ الحذف' },
+      rules: { providedBy: { create: 'never', update: 'never' } },
+    },
+  },
+  targets: {
+    // Every organization's rows on the platform, read-only, and each row's
+    // record, which only reads. A record is titled by its student, a person the
+    // platform reads, where a session is titled only by its start.
+    platform: {
+      useAsTitle: 'student',
+      pages: {
+        ...platformList('/enrollments', { columns: ['session', 'student', 'organization', 'createdAt'], filters: ['organization', 'session', 'student'], sort: '-createdAt' }),
+        ...platformRecord({
+          path: '/enrollments/:id',
+          main: [{ section: 'enrollment', label: { en: 'Enrollment', ar: 'التسجيل' }, fields: ['session', 'student', 'deletedAt'] }],
+        }),
+      },
+    },
+    service: { operations: defaultOperations },
+    // Both screens list enrollments; the portal's create opens as a drawer over
+    // its list. Titled by the student on the dashboard, as on the platform, so a
+    // tab and a heading tell one seat from another; on the portal, where the
+    // student is most often the viewer, by the session.
+    dashboard: {
+      useAsTitle: 'student',
+      description: {
+        en: 'Which student holds a seat in which session.',
+        ar: 'أي طالب يشغل مقعدا في أي حصة.',
+      },
+      pages: {
+        // The same table every kayan's list is. Searched by the student's name,
+        // the one column of a person a tenant reads, and filtered by session,
+        // student and when the student enrolled, as the course list is.
+        list: { path: '/enrollments', page: appPage([{ layout: 'table', main: [{ list: {
+          columns: ['session', 'student', 'createdAt'],
+          filters: ['session', 'student', 'createdAt'],
+          search: ['student.name'],
+        } }] }]) },
+        create: { path: '/enrollments/new', page: appPage([{ layout: 'record', main: [{ form: enrollment }] }]) },
+        // The editor layout, and the one timestamp worth reading here, named and
+        // read-only: when the student enrolled, beside the organization it
+        // belongs to, read by its name.
+        edit: {
+          path: '/enrollments/:id',
+          page: appPage([{
+            layout: 'record',
+            main: [{ form: enrollment }],
+            side: [{ section: 'record', label: { en: 'Record', ar: 'السجل' }, fields: [{ field: 'organization', readOnly: true }, { field: 'createdAt', readOnly: true }] }, activity],
+            danger: danger(),
+          }]),
+        },
+      },
+    },
+    portal: {
+      useAsTitle: 'session',
+      pages: {
+        list: { path: '/enrollments', page: topPage([{ layout: 'page', main: [{ list: { columns: ['session', 'createdAt'] } }] }]) },
+        // The student too, as the dashboard draws it, so an instructor picks
+        // whom it enrolls. A role without `enrollments.fields.student` is not
+        // projected the field and is drawn the session alone.
+        create: { path: '/enrollments/new', mode: 'drawer', page: topPage([{ layout: 'page', main: [{ form: ['session', 'student'] }] }]) },
+        edit: { path: '/enrollments/:id', page: topPage([{ layout: 'page', main: [{ form: ['session'] }] }]) },
+      },
+    },
+  },
+})

package/template/templates/asas/src/enrollments/ui/session-cell.tsx

@@ -0,0 +1,65 @@
+// What an enrollment's session column draws: the session's course by its title, then when it starts, which tells two sessions of one course apart.
+// A session is titled by its start and a title is one field, so the course is a second read.
+//
+// The list's own `useRelationshipTitles` keeps only each session's title, the start as text, and not the course it points at, so this cell reads them again:
+// one read of every session the page's rows point at and one of their courses, shared by every cell of the page through the query client rather than two per cell,
+// and read again once it is as old as the list's own pages. A read that failed is not kept, so the next one tries again.
+// Each read is the viewer's own, so a session or a course the viewer may not read is left out, and its cell keeps what it can say.
+import { use } from 'react'
+import { useQuery } from '@tanstack/react-query'
+import type { CellProps, FetchClient, Row } from 'mithaq/admin'
+import { ListContext, useClient, useLocale, useScreen } from 'mithaq/admin/react'
+import { formatDate, noValue, refusalKeyOf, type FoundPage } from '@/components/mithaq/controls.tsx'
+import { findByIds, nameOfRow, titleFieldOf } from '@/components/mithaq/relationship-control.tsx'
+
+/** A refusal is the viewer's access answering, so it reads as no rows; anything else is a failure, and throws for the query to try again. */
+const unread = (thrown: unknown): never[] => {
+  if (refusalKeyOf(thrown)) return []
+  throw thrown
+}
+
+const of = (client: FetchClient, kayan: string) => ({ find: (input: Record<string, unknown>) => client({ kayan, operation: 'find', input }) as Promise<FoundPage> })
+
+/** Some courses by id, as the viewer reads them, which the session picker's label reads too. */
+export const coursesOf = async ({ client, ids, maxLimit }: { client: FetchClient; ids: readonly string[]; maxLimit: number }): Promise<ReadonlyMap<string, Row>> => {
+  const courses = ids.length ? await findByIds({ reads: of(client, 'courses'), ids, maxLimit }).catch(unread) : []
+  return new Map(courses.map((one) => [String(one.id), one]))
+}
+
+const sessionsOf = async ({ client, ids, maxLimit }: { client: FetchClient; ids: readonly string[]; maxLimit: number }): Promise<ReadonlyMap<string, Row>> => {
+  const sessions = await findByIds({ reads: of(client, 'sessions'), ids, maxLimit }).catch(unread)
+  const courseIds = [...new Set(sessions.flatMap((one) => (typeof one.course === 'string' ? [one.course] : [])))]
+  const course = await coursesOf({ client, ids: courseIds, maxLimit })
+  return new Map(sessions.map((one) => [String(one.id), { ...one, course: course.get(String(one.course)) }]))
+}
+
+export function SessionCell({ field, value, row }: CellProps) {
+  const client = useClient()
+  const { locale, t } = useLocale()
+  const { kayan: { courses }, maxLimit } = useScreen()
+  // A list's page, or the one row a record page draws.
+  // Sorted, so the same rows in another order are the same query.
+  const ids = [...new Set((use(ListContext)?.page.docs ?? [row]).flatMap((one: Row) => (typeof one[field.name] === 'string' ? [one[field.name] as string] : [])))].sort()
+  const { data: sessions, isError } = useQuery({ queryKey: ['session-cell', ids], queryFn: () => sessionsOf({ client, ids, maxLimit }), staleTime: 30_000 })
+  if (typeof value !== 'string') return noValue
+  const session = sessions?.get(value)
+  const when = formatDate({ value: session?.startsAt, locale })
+  const course = session?.course ? nameOfRow({ row: session.course as Row, title: titleFieldOf(courses), locale }) : undefined
+  // Never the id the column holds, as the relationship cell draws none:
+  // loading until the read answers, the server's render among it, a dash
+  // where it failed, and a row the viewer cannot see for a session it may
+  // not read or one of which it may read neither the course nor the start.
+  if (!when && !course) {
+    if (sessions) return t('admin.cannotSee', 'You can\'t see this')
+    return isError ? '—' : t('admin.loading', 'Loading…')
+  }
+  // Two lines, the course over its start, so a narrow column wraps each
+  // whole rather than one into the other.
+  return (
+    <span className="grid">
+      {course ? <span className="font-medium">{course}</span> : null}
+      {/* One unbroken run, so a narrow column breaks between the course and the date and never inside the date. */}
+      {when ? <span className="text-muted-foreground text-xs"><bdi className="whitespace-nowrap">{when}</bdi></span> : null}
+    </span>
+  )
+}

package/template/templates/asas/src/kayan/auth/user/account.access.ts

@@ -0,0 +1,8 @@
+// This project's access for the generated `account` kayan, which `mithaq generate
+// auth` imports into `./account.ts` because this file sits beside it.
+//
+// Better Auth alone writes and reads this table, through its own adapter, so
+// every managed operation on it is refused to every actor. Written out rather
+// than left to the administrator's default, which a super admin passes in the
+// platform app.
+export { providerOnly as access } from '../../../tenant-access.ts'

package/template/templates/asas/src/kayan/auth/user/account.ts

@@ -0,0 +1,31 @@
+// Written by `mithaq generate auth` from the Better Auth options generate.providers names. Do not edit.
+// This kayan's access and what each screen draws of it are the project's:
+// `account.access.ts` exporting `access` and `account.screens.ts` exporting
+// `screens`, beside this file, are imported here on the next run. A kayan
+// built under this one's name elsewhere is refused by every relationship to it.
+import { defaultFields, defaultOperations } from 'mithaq'
+import { defineKayan } from '../../../mithaq.ts'
+import { user } from './user.ts'
+import { access } from './account.access.ts'
+
+export const account = defineKayan({
+  name: 'account',
+  targets: { service: { operations: defaultOperations } },
+  access,
+  fields: {
+    ...defaultFields,
+    id: { kind: 'text' },
+    accountId: { kind: 'text', rules: { required: true } },
+    providerId: { kind: 'text', rules: { required: true } },
+    userId: { kind: 'relationship', relationTo: () => user, dbName: 'user_id', rules: { required: true, onDelete: 'cascade' } },
+    accessToken: { kind: 'text' },
+    refreshToken: { kind: 'text' },
+    idToken: { kind: 'text' },
+    accessTokenExpiresAt: { kind: 'datetime' },
+    refreshTokenExpiresAt: { kind: 'datetime' },
+    scope: { kind: 'text' },
+    password: { kind: 'text' },
+    createdAt: { kind: 'datetime', rules: { required: true } },
+    updatedAt: { kind: 'datetime', rules: { required: true, nowOnUpdate: true, providedBy: { update: 'application' } } },
+  },
+})

package/template/templates/asas/src/kayan/auth/user/index.ts

@@ -0,0 +1,18 @@
+// Written by `mithaq generate auth` from the Better Auth options generate.providers names. Do not edit.
+// One key per plugin that brought tables of its own, and `core` for the tables
+// Better Auth ships without one, so a project spreads these lists into
+// `buildAsas` instead of naming every file. A plugin that leaves takes its key
+// with it, and `mithaq generate auth --check` reports the drift.
+import { account } from './account.ts'
+import { invitation } from './invitation.ts'
+import { member } from './member.ts'
+import { organization } from './organization.ts'
+import { organizationRole } from './organizationRole.ts'
+import { session } from './session.ts'
+import { user } from './user.ts'
+import { verification } from './verification.ts'
+
+export const betterAuth = {
+  core: [user, session, account, verification],
+  organization: [organization, organizationRole, member, invitation],
+} as const

package/template/templates/asas/src/kayan/auth/user/invitation.access.ts

@@ -0,0 +1,4 @@
+// Better Auth alone writes and reads this table, through its own adapter, so every managed
+// operation on it is refused to every actor. Written out rather than left to the administrator's
+// default, which a super admin passes.
+export { providerOnly as access } from '../../../tenant-access.ts'

package/template/templates/asas/src/kayan/auth/user/invitation.ts

@@ -0,0 +1,27 @@
+// Written by `mithaq generate auth` from the Better Auth options generate.providers names. Do not edit.
+// This kayan's access and what each screen draws of it are the project's:
+// `invitation.access.ts` exporting `access` and `invitation.screens.ts` exporting
+// `screens`, beside this file, are imported here on the next run. A kayan
+// built under this one's name elsewhere is refused by every relationship to it.
+import { defaultFields, defaultOperations } from 'mithaq'
+import { defineKayan } from '../../../mithaq.ts'
+import { organization } from './organization.ts'
+import { user } from './user.ts'
+import { access } from './invitation.access.ts'
+
+export const invitation = defineKayan({
+  name: 'invitation',
+  targets: { service: { operations: defaultOperations } },
+  access,
+  fields: {
+    ...defaultFields,
+    id: { kind: 'text' },
+    organizationId: { kind: 'relationship', relationTo: () => organization, dbName: 'organization_id', rules: { required: true, onDelete: 'cascade' } },
+    email: { kind: 'text', rules: { required: true } },
+    role: { kind: 'text' },
+    status: { kind: 'text', rules: { required: true } },
+    expiresAt: { kind: 'datetime', rules: { required: true } },
+    createdAt: { kind: 'datetime', rules: { required: true } },
+    inviterId: { kind: 'relationship', relationTo: () => user, dbName: 'inviter_id', rules: { required: true, onDelete: 'cascade' } },
+  },
+})

package/template/templates/asas/src/kayan/auth/user/member.access.ts

@@ -0,0 +1,10 @@
+// This project's access for the generated `member` kayan, which `mithaq
+// generate auth` imports into `./member.ts` because this file sits beside it. A
+// platform role reads every organization's members in the platform app, by the
+// keys it holds, and no one writes through it. There is no `'*'` row, so a
+// tenant's actor takes no row here and reads nothing: a tenant lists its
+// members through the provider's own `list-members`.
+import { rows } from '../../../mithaq.ts'
+import { platformReads } from '../../../tenant-access.ts'
+
+export const access = rows(platformReads)

package/template/templates/asas/src/kayan/auth/user/member.screens.ts

@@ -0,0 +1,37 @@
+// What the platform draws of the generated `member` kayan, which `mithaq
+// generate auth` imports into `./member.ts` because this file sits beside it:
+// every organization's members, each by the person's and the organization's name,
+// filtered to one organization from that organization's row.
+import { platformUi } from '../../../mithaq.ts'
+import { appPage } from '../../../pages.ts'
+
+/** The provider's governance role by the project's word for it, never its slug. */
+const role = { field: 'role', cell: platformUi('role-cells.tsx#MembershipRole') } as const
+
+export const screens = {
+  platform: {
+    // A membership's record is titled by its person.
+    useAsTitle: 'userId',
+    pages: {
+      list: {
+        path: '/members',
+        page: appPage([{ layout: 'table', main: [{ list: {
+          columns: ['userId', 'organizationId', role, 'createdAt'],
+          filters: ['organizationId', 'userId', 'role', 'createdAt'],
+          // A membership is looked for by its person.
+          search: ['userId.name', 'userId.email'],
+          sort: '-createdAt',
+        } }] }]),
+      },
+      // A membership's record, which a row opens and which only reads.
+      view: {
+        path: '/members/:id',
+        page: appPage([{
+          layout: 'record',
+          main: [{ section: 'membership', label: { en: 'Membership', ar: 'العضوية' }, fields: ['userId', 'organizationId', role] }],
+          side: [{ section: 'record', label: { en: 'Record', ar: 'السجل' }, fields: ['createdAt', 'updatedAt'] }],
+        }]),
+      },
+    },
+  },
+} as const

package/template/templates/asas/src/kayan/auth/user/member.ts

@@ -0,0 +1,25 @@
+// Written by `mithaq generate auth` from the Better Auth options generate.providers names. Do not edit.
+// This kayan's access and what each screen draws of it are the project's:
+// `member.access.ts` exporting `access` and `member.screens.ts` exporting
+// `screens`, beside this file, are imported here on the next run. A kayan
+// built under this one's name elsewhere is refused by every relationship to it.
+import { defaultFields, defaultOperations } from 'mithaq'
+import { defineKayan } from '../../../mithaq.ts'
+import { organization } from './organization.ts'
+import { user } from './user.ts'
+import { access } from './member.access.ts'
+import { screens } from './member.screens.ts'
+
+export const member = defineKayan({
+  name: 'member',
+  targets: { ...screens, service: { operations: defaultOperations } },
+  access,
+  fields: {
+    ...defaultFields,
+    id: { kind: 'text' },
+    organizationId: { kind: 'relationship', relationTo: () => organization, dbName: 'organization_id', rules: { required: true, onDelete: 'cascade' } },
+    userId: { kind: 'relationship', relationTo: () => user, dbName: 'user_id', rules: { required: true, onDelete: 'cascade' } },
+    role: { kind: 'text', rules: { required: true } },
+    createdAt: { kind: 'datetime', rules: { required: true } },
+  },
+})

package/template/templates/asas/src/kayan/auth/user/organization.access.ts

@@ -0,0 +1,20 @@
+// This project's access for the generated `organization` kayan, which `mithaq
+// generate auth` imports into `./organization.ts` because this file sits
+// beside it. The table is written here, beside the kayan it is for, and never
+// in a file every kayan shares.
+//
+// An organization is written through no managed operation: Better Auth writes
+// it through its own adapter, and the platform renames one through its own route.
+// In the tenant app a member reads its active organization, the one every tenant-owned
+// row belongs to, and by its id and its name alone, so a tenant
+// relationship shows a name on the dashboard. In the platform app a
+// platform role reads every organization, each column where it holds that
+// column's key. The id and the name are held by `namesInTenant` for the
+// reason `./user.access.ts` gives.
+import { rows } from '../../../mithaq.ts'
+import { namesInTenant, platformReads, user } from '../../../tenant-access.ts'
+
+export const access = rows(
+  { '*': { read: { id: { equals: user.activeOrganizationId } } }, ...platformReads },
+  { holds: namesInTenant('organization') },
+)

package/template/templates/asas/src/kayan/auth/user/organization.screens.ts

@@ -0,0 +1,37 @@
+// What each screen draws of the generated `organization` kayan, which `mithaq
+// generate auth` imports into `./organization.ts` because this file sits beside
+// it, spreading it into the kayan's `targets` after the generated titles of the
+// screens it does not name, so the platform's block here is that screen's whole
+// block, its title included, and the dashboard keeps the generated one. The
+// platform lists every organization with the registry's list and renames it or
+// opens its members from the slug column.
+import { platformUi } from '../../../mithaq.ts'
+import { appPage } from '../../../pages.ts'
+
+export const screens = {
+  platform: {
+    useAsTitle: 'name',
+    pages: {
+      list: {
+        path: '/organizations',
+        page: appPage([{ layout: 'table', main: [{ list: {
+          columns: ['name', { field: 'slug', cell: platformUi('organization-actions.tsx#OrganizationActions') }, 'createdAt'],
+          filters: ['name', 'slug', 'createdAt'],
+          search: ['name', 'slug'],
+          sort: 'name',
+        } }] }]),
+      },
+      // An organization's record, which a row opens and which only reads; its
+      // rename and its members stay on the list's slug column.
+      view: {
+        path: '/organizations/:id',
+        page: appPage([{
+          layout: 'record',
+          main: [{ section: 'organization', label: { en: 'Organization', ar: 'المؤسسة' }, fields: ['name', 'slug', 'logo', 'metadata'] }],
+          // No id: the record is read by its name.
+          side: [{ section: 'record', label: { en: 'Record', ar: 'السجل' }, fields: ['createdAt', 'updatedAt'] }],
+        }]),
+      },
+    },
+  },
+} as const

package/template/templates/asas/src/kayan/auth/user/organization.ts

@@ -0,0 +1,24 @@
+// Written by `mithaq generate auth` from the Better Auth options generate.providers names. Do not edit.
+// This kayan's access and what each screen draws of it are the project's:
+// `organization.access.ts` exporting `access` and `organization.screens.ts` exporting
+// `screens`, beside this file, are imported here on the next run. A kayan
+// built under this one's name elsewhere is refused by every relationship to it.
+import { defaultFields, defaultOperations } from 'mithaq'
+import { defineKayan } from '../../../mithaq.ts'
+import { access } from './organization.access.ts'
+import { screens } from './organization.screens.ts'
+
+export const organization = defineKayan({
+  name: 'organization',
+  targets: { dashboard: { useAsTitle: 'name' }, ...screens, service: { operations: defaultOperations } },
+  access,
+  fields: {
+    ...defaultFields,
+    id: { kind: 'text' },
+    name: { kind: 'text', rules: { required: true } },
+    slug: { kind: 'text', rules: { required: true, unique: true } },
+    logo: { kind: 'text' },
+    createdAt: { kind: 'datetime', rules: { required: true } },
+    metadata: { kind: 'text' },
+  },
+})

package/template/templates/asas/src/kayan/auth/user/organizationRole.access.ts

@@ -0,0 +1,8 @@
+// This project's access for the generated `organizationRole` kayan, which `mithaq generate
+// auth` imports into `./organizationRole.ts` because this file sits beside it.
+//
+// Better Auth alone writes and reads this table, through its own adapter,
+// so every managed operation on it is refused to every actor. Written out
+// rather than left to the administrator's default, which a super admin
+// passes in the platform app.
+export { providerOnly as access } from '../../../tenant-access.ts'

package/template/templates/asas/src/kayan/auth/user/organizationRole.ts

@@ -0,0 +1,25 @@
+// Written by `mithaq generate auth` from the Better Auth options generate.providers names. Do not edit.
+// This kayan's access and what each screen draws of it are the project's:
+// `organizationRole.access.ts` exporting `access` and `organizationRole.screens.ts` exporting
+// `screens`, beside this file, are imported here on the next run. A kayan
+// built under this one's name elsewhere is refused by every relationship to it.
+import { defaultFields, defaultOperations } from 'mithaq'
+import { defineKayan } from '../../../mithaq.ts'
+import { organization } from './organization.ts'
+import { access } from './organizationRole.access.ts'
+
+export const organizationRole = defineKayan({
+  name: 'organizationRole',
+  dbName: 'organization_role',
+  targets: { service: { operations: defaultOperations } },
+  access,
+  fields: {
+    ...defaultFields,
+    id: { kind: 'text' },
+    organizationId: { kind: 'relationship', relationTo: () => organization, dbName: 'organization_id', rules: { required: true, onDelete: 'cascade' } },
+    role: { kind: 'text', rules: { required: true } },
+    permission: { kind: 'text', rules: { required: true } },
+    createdAt: { kind: 'datetime', rules: { required: true } },
+    updatedAt: { kind: 'datetime', rules: { nowOnUpdate: true, providedBy: { update: 'application' } } },
+  },
+})

package/template/templates/asas/src/kayan/auth/user/session.access.ts

@@ -0,0 +1,8 @@
+// This project's access for the generated `session` kayan, which `mithaq generate
+// auth` imports into `./session.ts` because this file sits beside it.
+//
+// Better Auth alone writes and reads this table, through its own adapter, so
+// every managed operation on it is refused to every actor. Written out rather
+// than left to the administrator's default, which a super admin passes in the
+// platform app.
+export { providerOnly as access } from '../../../tenant-access.ts'

package/template/templates/asas/src/kayan/auth/user/session.ts

@@ -0,0 +1,28 @@
+// Written by `mithaq generate auth` from the Better Auth options generate.providers names. Do not edit.
+// This kayan's access and what each screen draws of it are the project's:
+// `session.access.ts` exporting `access` and `session.screens.ts` exporting
+// `screens`, beside this file, are imported here on the next run. A kayan
+// built under this one's name elsewhere is refused by every relationship to it.
+import { defaultFields, defaultOperations } from 'mithaq'
+import { defineKayan } from '../../../mithaq.ts'
+import { user } from './user.ts'
+import { access } from './session.access.ts'
+
+export const session = defineKayan({
+  name: 'session',
+  targets: { service: { operations: defaultOperations } },
+  access,
+  fields: {
+    ...defaultFields,
+    id: { kind: 'text' },
+    expiresAt: { kind: 'datetime', rules: { required: true } },
+    token: { kind: 'text', rules: { required: true, unique: true } },
+    createdAt: { kind: 'datetime', rules: { required: true } },
+    updatedAt: { kind: 'datetime', rules: { required: true, nowOnUpdate: true, providedBy: { update: 'application' } } },
+    ipAddress: { kind: 'text' },
+    userAgent: { kind: 'text' },
+    userId: { kind: 'relationship', relationTo: () => user, dbName: 'user_id', rules: { required: true, onDelete: 'cascade' } },
+    impersonatedBy: { kind: 'text' },
+    activeOrganizationId: { kind: 'text' },
+  },
+})

package/template/templates/asas/src/kayan/auth/user/user.access.ts

@@ -0,0 +1,29 @@
+// This project's access for the generated `user` kayan, which `mithaq generate
+// auth` imports into `./user.ts` because this file sits beside it. The table is
+// written here, beside the kayan it is for, and never in a file every kayan
+// shares.
+//
+// A person is written through no managed operation: Better Auth writes it
+// through its own adapter. The two sides of the platform line read it
+// differently, and neither row reaches the other's side. In the tenant app a
+// member reads its active organization's members by their id and their name
+// alone, so a relationship to a person shows a name in the dashboard's cell and
+// picker, and no email, role or ban reaches a tenant. In the platform app a
+// platform role reads every person, each column where it holds that column's key.
+//
+// The id and the name are held by `namesInTenant` rather than by a field list
+// on the `'*'` row, because every actor with a role takes the `'*'` row, the
+// platform's included, and a column one row's list leaves out is hidden
+// whatever the other rows say.
+//
+// The `'*'` row reads every person, and `membersOf` narrows it to the active
+// organization's members: a person carries no tenant column, and a row filter
+// reaches one relationship hop from the kayan's own fields, which `user` has
+// none of toward `member`.
+import { rows, serverTargets } from '../../../mithaq.ts'
+import { membersOf, namesInTenant, platformReads } from '../../../tenant-access.ts'
+
+export const access = {
+  ...rows({ '*': { read: true }, ...platformReads }, { holds: namesInTenant('user') }),
+  read: membersOf(serverTargets.drizzle),
+}