create-mithaq 0.0.0-stage → 0.2.0

package/template/templates/features/auth/user/member.screens.ts

@@ -0,0 +1,37 @@
+// What the backoffice draws of the generated `member` kayan, which `mithaq
+// generate auth` imports into `./member.ts` because this file sits beside it:
+// every organization's members, each by the person's and the organization's name,
+// filtered to one organization from that organization's row.
+import { backofficeUi } from '@asas/mithaq'
+import { appPage } from '@asas/mithaq/mithaq/pages.ts'
+
+/** The provider's governance role by the project's word for it, never its slug. */
+const role = { field: 'role', cell: backofficeUi('role-cells.tsx#MembershipRole') } as const
+
+export const screens = {
+  backoffice: {
+    // A membership's record is titled by its person.
+    useAsTitle: 'userId',
+    pages: {
+      list: {
+        path: '/members',
+        page: appPage([{ layout: 'table', main: [{ list: {
+          columns: ['userId', 'organizationId', role, 'createdAt'],
+          filters: ['organizationId', 'userId', 'role', 'createdAt'],
+          // A membership is looked for by its person.
+          search: ['userId.name', 'userId.email'],
+          sort: '-createdAt',
+        } }] }]),
+      },
+      // A membership's record, which a row opens and which only reads.
+      view: {
+        path: '/members/:id',
+        page: appPage([{
+          layout: 'record',
+          main: [{ section: 'membership', label: { en: 'Membership', ar: 'العضوية' }, fields: ['userId', 'organizationId', role] }],
+          side: [{ section: 'record', label: { en: 'Record', ar: 'السجل' }, fields: ['createdAt', 'updatedAt'] }],
+        }]),
+      },
+    },
+  },
+} as const

package/template/templates/features/auth/user/member.ts

@@ -0,0 +1,26 @@
+// Written by `mithaq generate auth` from the Better Auth options generate.providers names. Do not edit.
+// This kayan's access and what each screen draws of it are the project's:
+// `member.access.ts` exporting `access` and `member.screens.ts` exporting
+// `screens`, beside this file, are imported here on the next run. A kayan
+// built under this one's name elsewhere is refused by every relationship to it.
+import { defaultFields, defaultOperations } from 'mithaq'
+import { defineKayan } from '@asas/mithaq'
+import { organization } from './organization.ts'
+import { user } from './user.ts'
+import { access } from './member.access.ts'
+import { screens } from './member.screens.ts'
+
+export const member = defineKayan({
+  name: 'member',
+  targets: { ...screens, service: { operations: defaultOperations } },
+  access,
+  fields: {
+    ...defaultFields,
+    id: { kind: 'text' },
+    organizationId: { kind: 'relationship', relationTo: () => organization, dbName: 'organization_id', rules: { required: true, index: true, onDelete: 'cascade' } },
+    userId: { kind: 'relationship', relationTo: () => user, dbName: 'user_id', rules: { required: true, index: true, onDelete: 'cascade' } },
+    role: { kind: 'text', rules: { required: true } },
+    createdAt: { kind: 'datetime', rules: { required: true } },
+    lastSeenAt: { kind: 'datetime' },
+  },
+})

package/template/templates/features/auth/user/organization.access.ts

@@ -0,0 +1,20 @@
+// This project's access for the generated `organization` kayan, which `mithaq
+// generate auth` imports into `./organization.ts` because this file sits
+// beside it. The table is written here, beside the kayan it is for, and never
+// in a file every kayan shares.
+//
+// An organization is written through no managed operation: Better Auth writes
+// it through its own adapter, and the backoffice renames one through its own route.
+// In the tenant app a member reads its active organization, the one every tenant-owned
+// row belongs to, and by its id and its name alone, so a tenant
+// relationship shows a name on the dashboard. In the backoffice app a
+// backoffice role reads every organization, each column where it holds that
+// column's key. The id and the name are held by `namesInTenant` for the
+// reason `./user.access.ts` gives.
+import { rows } from '@asas/mithaq'
+import { namesInTenant, backofficeReads, user } from '@asas/mithaq/roles/tenant-access.ts'
+
+export const access = rows(
+  { '*': { read: { id: { equals: user.activeOrganizationId } } }, ...backofficeReads },
+  { holds: namesInTenant('organization') },
+)

package/template/templates/features/auth/user/organization.screens.ts

@@ -0,0 +1,37 @@
+// What each screen draws of the generated `organization` kayan, which `mithaq
+// generate auth` imports into `./organization.ts` because this file sits beside
+// it, spreading it into the kayan's `targets` after the generated titles of the
+// screens it does not name, so the backoffice's block here is that screen's whole
+// block, its title included, and the dashboard keeps the generated one. The
+// backoffice lists every organization with the registry's list and renames it or
+// opens its members from the slug column.
+import { backofficeUi } from '@asas/mithaq'
+import { appPage } from '@asas/mithaq/mithaq/pages.ts'
+
+export const screens = {
+  backoffice: {
+    useAsTitle: 'name',
+    pages: {
+      list: {
+        path: '/organizations',
+        page: appPage([{ layout: 'table', main: [{ list: {
+          columns: ['name', { field: 'slug', cell: backofficeUi('organization-actions.tsx#OrganizationActions') }, 'createdAt'],
+          filters: ['name', 'slug', 'createdAt'],
+          search: ['name', 'slug'],
+          sort: 'name',
+        } }] }]),
+      },
+      // An organization's record, which a row opens and which only reads; its
+      // rename and its members stay on the list's slug column.
+      view: {
+        path: '/organizations/:id',
+        page: appPage([{
+          layout: 'record',
+          main: [{ section: 'organization', label: { en: 'Organization', ar: 'المؤسسة' }, fields: ['name', 'slug', 'logo', 'metadata'] }],
+          // No id: the record is read by its name.
+          side: [{ section: 'record', label: { en: 'Record', ar: 'السجل' }, fields: ['createdAt', 'updatedAt'] }],
+        }]),
+      },
+    },
+  },
+} as const

package/template/templates/features/auth/user/organization.ts

@@ -0,0 +1,25 @@
+// Written by `mithaq generate auth` from the Better Auth options generate.providers names. Do not edit.
+// This kayan's access and what each screen draws of it are the project's:
+// `organization.access.ts` exporting `access` and `organization.screens.ts` exporting
+// `screens`, beside this file, are imported here on the next run. A kayan
+// built under this one's name elsewhere is refused by every relationship to it.
+import { defaultFields, defaultOperations } from 'mithaq'
+import { defineKayan } from '@asas/mithaq'
+import { access } from './organization.access.ts'
+import { screens } from './organization.screens.ts'
+
+export const organization = defineKayan({
+  name: 'organization',
+  targets: { dashboard: { useAsTitle: 'name' }, ...screens, service: { operations: defaultOperations } },
+  access,
+  fields: {
+    ...defaultFields,
+    id: { kind: 'text' },
+    name: { kind: 'text', rules: { required: true } },
+    slug: { kind: 'text', rules: { required: true, unique: true } },
+    logo: { kind: 'text' },
+    createdAt: { kind: 'datetime', rules: { required: true } },
+    metadata: { kind: 'text' },
+    names: { kind: 'text' },
+  },
+})

package/template/templates/features/auth/user/organizationRole.access.ts

@@ -0,0 +1,8 @@
+// This project's access for the generated `organizationRole` kayan, which `mithaq generate
+// auth` imports into `./organizationRole.ts` because this file sits beside it.
+//
+// Better Auth alone writes and reads this table, through its own adapter,
+// so every managed operation on it is refused to every actor. Written out
+// rather than left to the administrator's default, which a super admin
+// passes in the backoffice app.
+export { providerOnly as access } from '@asas/mithaq/roles/tenant-access.ts'

package/template/templates/features/auth/user/organizationRole.ts

@@ -0,0 +1,25 @@
+// Written by `mithaq generate auth` from the Better Auth options generate.providers names. Do not edit.
+// This kayan's access and what each screen draws of it are the project's:
+// `organizationRole.access.ts` exporting `access` and `organizationRole.screens.ts` exporting
+// `screens`, beside this file, are imported here on the next run. A kayan
+// built under this one's name elsewhere is refused by every relationship to it.
+import { defaultFields, defaultOperations } from 'mithaq'
+import { defineKayan } from '@asas/mithaq'
+import { organization } from './organization.ts'
+import { access } from './organizationRole.access.ts'
+
+export const organizationRole = defineKayan({
+  name: 'organizationRole',
+  dbName: 'organization_role',
+  targets: { service: { operations: defaultOperations } },
+  access,
+  fields: {
+    ...defaultFields,
+    id: { kind: 'text' },
+    organizationId: { kind: 'relationship', relationTo: () => organization, dbName: 'organization_id', rules: { required: true, index: true, onDelete: 'cascade' } },
+    role: { kind: 'text', rules: { required: true, index: true } },
+    permission: { kind: 'text', rules: { required: true } },
+    createdAt: { kind: 'datetime', rules: { required: true } },
+    updatedAt: { kind: 'datetime', rules: { nowOnUpdate: true, providedBy: { update: 'application' } } },
+  },
+})

package/template/templates/features/auth/user/session.access.ts

@@ -0,0 +1,8 @@
+// This project's access for the generated `session` kayan, which `mithaq generate
+// auth` imports into `./session.ts` because this file sits beside it.
+//
+// Better Auth alone writes and reads this table, through its own adapter, so
+// every managed operation on it is refused to every actor. Written out rather
+// than left to the administrator's default, which a super admin passes in the
+// backoffice app.
+export { providerOnly as access } from '@asas/mithaq/roles/tenant-access.ts'

package/template/templates/features/auth/user/session.ts

@@ -0,0 +1,28 @@
+// Written by `mithaq generate auth` from the Better Auth options generate.providers names. Do not edit.
+// This kayan's access and what each screen draws of it are the project's:
+// `session.access.ts` exporting `access` and `session.screens.ts` exporting
+// `screens`, beside this file, are imported here on the next run. A kayan
+// built under this one's name elsewhere is refused by every relationship to it.
+import { defaultFields, defaultOperations } from 'mithaq'
+import { defineKayan } from '@asas/mithaq'
+import { user } from './user.ts'
+import { access } from './session.access.ts'
+
+export const session = defineKayan({
+  name: 'session',
+  targets: { service: { operations: defaultOperations } },
+  access,
+  fields: {
+    ...defaultFields,
+    id: { kind: 'text' },
+    expiresAt: { kind: 'datetime', rules: { required: true } },
+    token: { kind: 'text', rules: { required: true, unique: true } },
+    createdAt: { kind: 'datetime', rules: { required: true } },
+    updatedAt: { kind: 'datetime', rules: { required: true, nowOnUpdate: true, providedBy: { update: 'application' } } },
+    ipAddress: { kind: 'text' },
+    userAgent: { kind: 'text' },
+    userId: { kind: 'relationship', relationTo: () => user, dbName: 'user_id', rules: { required: true, index: true, onDelete: 'cascade' } },
+    impersonatedBy: { kind: 'text' },
+    activeOrganizationId: { kind: 'text' },
+  },
+})

package/template/templates/features/auth/user/user.access.ts

@@ -0,0 +1,30 @@
+// This project's access for the generated `user` kayan, which `mithaq generate
+// auth` imports into `./user.ts` because this file sits beside it. The table is
+// written here, beside the kayan it is for, and never in a file every kayan
+// shares.
+//
+// A person is written through no managed operation: Better Auth writes it
+// through its own adapter. The two sides of the backoffice line read it
+// differently, and neither row reaches the other's side. In the tenant app a
+// member reads its active organization's members by their id and their name
+// alone, so a relationship to a person shows a name in the dashboard's cell and
+// picker, and no email, role or ban reaches a tenant. Which members: all of them
+// to a holder of `member.find`, otherwise itself and its roles' `peopleAudience`. In the backoffice app a
+// backoffice role reads every person, each column where it holds that column's key.
+//
+// The id and the name are held by `namesInTenant` rather than by a field list
+// on the `'*'` row, because every actor with a role takes the `'*'` row, the
+// backoffice's included, and a column one row's list leaves out is hidden
+// whatever the other rows say.
+//
+// The `'*'` row reads every person, and `membersOf` narrows it to the active
+// organization's members: a person carries no tenant column, and a row filter
+// reaches one relationship hop from the kayan's own fields, which `user` has
+// none of toward `member`.
+import { rows, serverTargets } from '@asas/mithaq'
+import { membersOf, namesInTenant, backofficeReads } from '@asas/mithaq/roles/tenant-access.ts'
+
+export const access = {
+  ...rows({ '*': { read: true }, ...backofficeReads }, { holds: namesInTenant('user') }),
+  read: membersOf(serverTargets.drizzle),
+}

package/template/templates/features/auth/user/user.screens.ts

@@ -0,0 +1,45 @@
+// What each screen draws of the generated `user` kayan, which `mithaq generate
+// auth` imports into `./user.ts` because this file sits beside it, spreading it
+// into the kayan's `targets` after the generated titles of the screens it does
+// not name, so the backoffice's block here is that screen's whole block, its
+// title included, and the dashboard keeps the generated one. The dashboard
+// titles a person by name for its cells and pickers, and the backoffice lists
+// every person with the registry's list and acts on each from its row's menu
+// and its own page.
+import { backofficeUi } from '@asas/mithaq'
+import { appPage } from '@asas/mithaq/mithaq/pages.ts'
+
+export const screens = {
+  backoffice: {
+    useAsTitle: 'name',
+    pages: {
+      list: {
+        path: '/users',
+        page: appPage([{ layout: 'table', main: [{ list: {
+          columns: ['name', 'email', { field: 'role', cell: backofficeUi('user-actions.tsx#BackofficeRole') }, 'banned', 'createdAt'],
+          filters: ['name', 'email', 'role', 'banned', 'createdAt'],
+          search: ['name', 'email'],
+          sort: 'email',
+          // Set role, ban and impersonate, after the row menu's View.
+          menu: backofficeUi('user-actions.tsx#UserMenu'),
+        } }] }]),
+      },
+      // A person's record, which a row opens and which only reads: every
+      // column drawn by its cell, under the actions the row's menu offers, as buttons.
+      view: {
+        path: '/users/:id',
+        page: appPage([{
+          layout: 'record',
+          main: [
+            { component: backofficeUi('user-actions.tsx#UserButtons') },
+            { section: 'person', label: { en: 'Person', ar: 'الشخص' }, fields: ['name', 'email', 'emailVerified', 'image'] },
+            // The role by its label, where the column holds the slugs.
+            { section: 'standing', label: { en: 'Standing in the backoffice', ar: 'الوضع في لوحة الإدارة الخلفية' }, fields: [{ field: 'role', cell: backofficeUi('user-actions.tsx#BackofficeRole') }, 'banned', 'banReason', 'banExpires'] },
+          ],
+          // No id: a person reads the record by its name, and the address bar holds the id.
+          side: [{ section: 'record', label: { en: 'Record', ar: 'السجل' }, fields: ['createdAt', 'updatedAt'] }],
+        }]),
+      },
+    },
+  },
+} as const

package/template/templates/features/auth/user/user.ts

@@ -0,0 +1,31 @@
+// Written by `mithaq generate auth` from the Better Auth options generate.providers names. Do not edit.
+// This kayan's access and what each screen draws of it are the project's:
+// `user.access.ts` exporting `access` and `user.screens.ts` exporting
+// `screens`, beside this file, are imported here on the next run. A kayan
+// built under this one's name elsewhere is refused by every relationship to it.
+import { betterAuth, defaultFields, defaultOperations } from 'mithaq'
+import { defineKayan } from '@asas/mithaq'
+import { providers } from '@asas/mithaq/auth'
+import { access } from './user.access.ts'
+import { screens } from './user.screens.ts'
+
+export const user = defineKayan({
+  name: 'user',
+  auth: betterAuth({ server: providers.user.server }),
+  targets: { dashboard: { useAsTitle: 'name' }, portal: { useAsTitle: 'name' }, ...screens, service: { operations: defaultOperations } },
+  access,
+  fields: {
+    ...defaultFields,
+    id: { kind: 'text' },
+    name: { kind: 'text', rules: { required: true } },
+    email: { kind: 'text', rules: { required: true, unique: true } },
+    emailVerified: { kind: 'checkbox', rules: { required: true } },
+    image: { kind: 'text' },
+    createdAt: { kind: 'datetime', rules: { required: true } },
+    updatedAt: { kind: 'datetime', rules: { required: true, nowOnUpdate: true, providedBy: { update: 'application' } } },
+    role: { kind: 'text' },
+    banned: { kind: 'checkbox' },
+    banReason: { kind: 'text' },
+    banExpires: { kind: 'datetime' },
+  },
+})

package/template/templates/features/auth/user/verification.access.ts

@@ -0,0 +1,8 @@
+// This project's access for the generated `verification` kayan, which `mithaq generate
+// auth` imports into `./verification.ts` because this file sits beside it.
+//
+// Better Auth alone writes and reads this table, through its own adapter, so
+// every managed operation on it is refused to every actor. Written out rather
+// than left to the administrator's default, which a super admin passes in the
+// backoffice app.
+export { providerOnly as access } from '@asas/mithaq/roles/tenant-access.ts'

package/template/templates/features/auth/user/verification.ts

@@ -0,0 +1,23 @@
+// Written by `mithaq generate auth` from the Better Auth options generate.providers names. Do not edit.
+// This kayan's access and what each screen draws of it are the project's:
+// `verification.access.ts` exporting `access` and `verification.screens.ts` exporting
+// `screens`, beside this file, are imported here on the next run. A kayan
+// built under this one's name elsewhere is refused by every relationship to it.
+import { defaultFields, defaultOperations } from 'mithaq'
+import { defineKayan } from '@asas/mithaq'
+import { access } from './verification.access.ts'
+
+export const verification = defineKayan({
+  name: 'verification',
+  targets: { service: { operations: defaultOperations } },
+  access,
+  fields: {
+    ...defaultFields,
+    id: { kind: 'text' },
+    identifier: { kind: 'text', rules: { required: true, index: true } },
+    value: { kind: 'text', rules: { required: true } },
+    expiresAt: { kind: 'datetime', rules: { required: true } },
+    createdAt: { kind: 'datetime', rules: { required: true } },
+    updatedAt: { kind: 'datetime', rules: { required: true, nowOnUpdate: true, providedBy: { update: 'application' } } },
+  },
+})