create-mithaq 0.1.1 → 0.2.0

package/template/templates/{auth → features/auth}/package.json

@@ -4,11 +4,10 @@
   "private": true,
   "type": "module",
   "exports": {
-    ".": "./src/index.ts",
-    "./platform-roles": "./src/platform-roles.ts"
+    ".": "./index.ts"
   },
   "dependencies": {
-    "better-auth": "1.7.4",
+    "@asas/mithaq": "*",
     "mithaq": "*"
   }
 }

package/template/templates/{asas/src/kayan → features}/auth/user/account.access.ts

@@ -4,5 +4,5 @@
 // Better Auth alone writes and reads this table, through its own adapter, so
 // every managed operation on it is refused to every actor. Written out rather
 // than left to the administrator's default, which a super admin passes in the
-// platform app.
-export { providerOnly as access } from '../../../tenant-access.ts'
+// backoffice app.
+export { providerOnly as access } from '@asas/mithaq/roles/tenant-access.ts'

package/template/templates/{asas/src/kayan → features}/auth/user/account.ts

@@ -4,7 +4,7 @@
 // `screens`, beside this file, are imported here on the next run. A kayan
 // built under this one's name elsewhere is refused by every relationship to it.
 import { defaultFields, defaultOperations } from 'mithaq'
-import { defineKayan } from '../../../mithaq.ts'
+import { defineKayan } from '@asas/mithaq'
 import { user } from './user.ts'
 import { access } from './account.access.ts'
 
@@ -17,7 +17,7 @@ export const account = defineKayan({
     id: { kind: 'text' },
     accountId: { kind: 'text', rules: { required: true } },
     providerId: { kind: 'text', rules: { required: true } },
-    userId: { kind: 'relationship', relationTo: () => user, dbName: 'user_id', rules: { required: true, onDelete: 'cascade' } },
+    userId: { kind: 'relationship', relationTo: () => user, dbName: 'user_id', rules: { required: true, index: true, onDelete: 'cascade' } },
     accessToken: { kind: 'text' },
     refreshToken: { kind: 'text' },
     idToken: { kind: 'text' },

package/template/templates/{asas/src/kayan → features}/auth/user/invitation.access.ts

@@ -1,4 +1,4 @@
 // Better Auth alone writes and reads this table, through its own adapter, so every managed
 // operation on it is refused to every actor. Written out rather than left to the administrator's
 // default, which a super admin passes.
-export { providerOnly as access } from '../../../tenant-access.ts'
+export { providerOnly as access } from '@asas/mithaq/roles/tenant-access.ts'

package/template/templates/{asas/src/kayan → features}/auth/user/invitation.ts

@@ -4,7 +4,7 @@
 // `screens`, beside this file, are imported here on the next run. A kayan
 // built under this one's name elsewhere is refused by every relationship to it.
 import { defaultFields, defaultOperations } from 'mithaq'
-import { defineKayan } from '../../../mithaq.ts'
+import { defineKayan } from '@asas/mithaq'
 import { organization } from './organization.ts'
 import { user } from './user.ts'
 import { access } from './invitation.access.ts'
@@ -16,8 +16,8 @@ export const invitation = defineKayan({
   fields: {
     ...defaultFields,
     id: { kind: 'text' },
-    organizationId: { kind: 'relationship', relationTo: () => organization, dbName: 'organization_id', rules: { required: true, onDelete: 'cascade' } },
-    email: { kind: 'text', rules: { required: true } },
+    organizationId: { kind: 'relationship', relationTo: () => organization, dbName: 'organization_id', rules: { required: true, index: true, onDelete: 'cascade' } },
+    email: { kind: 'text', rules: { required: true, index: true } },
     role: { kind: 'text' },
     status: { kind: 'text', rules: { required: true } },
     expiresAt: { kind: 'datetime', rules: { required: true } },

package/template/templates/{asas/src/kayan → features}/auth/user/member.access.ts

@@ -1,10 +1,10 @@
 // This project's access for the generated `member` kayan, which `mithaq
 // generate auth` imports into `./member.ts` because this file sits beside it. A
-// platform role reads every organization's members in the platform app, by the
+// backoffice role reads every organization's members in the backoffice app, by the
 // keys it holds, and no one writes through it. There is no `'*'` row, so a
 // tenant's actor takes no row here and reads nothing: a tenant lists its
 // members through the provider's own `list-members`.
-import { rows } from '../../../mithaq.ts'
-import { platformReads } from '../../../tenant-access.ts'
+import { rows } from '@asas/mithaq'
+import { backofficeReads } from '@asas/mithaq/roles/tenant-access.ts'
 
-export const access = rows(platformReads)
+export const access = rows(backofficeReads)

package/template/templates/{asas/src/kayan → features}/auth/user/member.screens.ts

@@ -1,15 +1,15 @@
-// What the platform draws of the generated `member` kayan, which `mithaq
+// What the backoffice draws of the generated `member` kayan, which `mithaq
 // generate auth` imports into `./member.ts` because this file sits beside it:
 // every organization's members, each by the person's and the organization's name,
 // filtered to one organization from that organization's row.
-import { platformUi } from '../../../mithaq.ts'
-import { appPage } from '../../../pages.ts'
+import { backofficeUi } from '@asas/mithaq'
+import { appPage } from '@asas/mithaq/mithaq/pages.ts'
 
 /** The provider's governance role by the project's word for it, never its slug. */
-const role = { field: 'role', cell: platformUi('role-cells.tsx#MembershipRole') } as const
+const role = { field: 'role', cell: backofficeUi('role-cells.tsx#MembershipRole') } as const
 
 export const screens = {
-  platform: {
+  backoffice: {
     // A membership's record is titled by its person.
     useAsTitle: 'userId',
     pages: {

package/template/templates/{asas/src/kayan → features}/auth/user/member.ts

@@ -4,7 +4,7 @@
 // `screens`, beside this file, are imported here on the next run. A kayan
 // built under this one's name elsewhere is refused by every relationship to it.
 import { defaultFields, defaultOperations } from 'mithaq'
-import { defineKayan } from '../../../mithaq.ts'
+import { defineKayan } from '@asas/mithaq'
 import { organization } from './organization.ts'
 import { user } from './user.ts'
 import { access } from './member.access.ts'
@@ -17,9 +17,10 @@ export const member = defineKayan({
   fields: {
     ...defaultFields,
     id: { kind: 'text' },
-    organizationId: { kind: 'relationship', relationTo: () => organization, dbName: 'organization_id', rules: { required: true, onDelete: 'cascade' } },
-    userId: { kind: 'relationship', relationTo: () => user, dbName: 'user_id', rules: { required: true, onDelete: 'cascade' } },
+    organizationId: { kind: 'relationship', relationTo: () => organization, dbName: 'organization_id', rules: { required: true, index: true, onDelete: 'cascade' } },
+    userId: { kind: 'relationship', relationTo: () => user, dbName: 'user_id', rules: { required: true, index: true, onDelete: 'cascade' } },
     role: { kind: 'text', rules: { required: true } },
     createdAt: { kind: 'datetime', rules: { required: true } },
+    lastSeenAt: { kind: 'datetime' },
   },
 })

package/template/templates/{asas/src/kayan → features}/auth/user/organization.access.ts

@@ -4,17 +4,17 @@
 // in a file every kayan shares.
 //
 // An organization is written through no managed operation: Better Auth writes
-// it through its own adapter, and the platform renames one through its own route.
+// it through its own adapter, and the backoffice renames one through its own route.
 // In the tenant app a member reads its active organization, the one every tenant-owned
 // row belongs to, and by its id and its name alone, so a tenant
-// relationship shows a name on the dashboard. In the platform app a
-// platform role reads every organization, each column where it holds that
+// relationship shows a name on the dashboard. In the backoffice app a
+// backoffice role reads every organization, each column where it holds that
 // column's key. The id and the name are held by `namesInTenant` for the
 // reason `./user.access.ts` gives.
-import { rows } from '../../../mithaq.ts'
-import { namesInTenant, platformReads, user } from '../../../tenant-access.ts'
+import { rows } from '@asas/mithaq'
+import { namesInTenant, backofficeReads, user } from '@asas/mithaq/roles/tenant-access.ts'
 
 export const access = rows(
-  { '*': { read: { id: { equals: user.activeOrganizationId } } }, ...platformReads },
+  { '*': { read: { id: { equals: user.activeOrganizationId } } }, ...backofficeReads },
   { holds: namesInTenant('organization') },
 )

package/template/templates/{asas/src/kayan → features}/auth/user/organization.screens.ts

@@ -1,21 +1,21 @@
 // What each screen draws of the generated `organization` kayan, which `mithaq
 // generate auth` imports into `./organization.ts` because this file sits beside
 // it, spreading it into the kayan's `targets` after the generated titles of the
-// screens it does not name, so the platform's block here is that screen's whole
+// screens it does not name, so the backoffice's block here is that screen's whole
 // block, its title included, and the dashboard keeps the generated one. The
-// platform lists every organization with the registry's list and renames it or
+// backoffice lists every organization with the registry's list and renames it or
 // opens its members from the slug column.
-import { platformUi } from '../../../mithaq.ts'
-import { appPage } from '../../../pages.ts'
+import { backofficeUi } from '@asas/mithaq'
+import { appPage } from '@asas/mithaq/mithaq/pages.ts'
 
 export const screens = {
-  platform: {
+  backoffice: {
     useAsTitle: 'name',
     pages: {
       list: {
         path: '/organizations',
         page: appPage([{ layout: 'table', main: [{ list: {
-          columns: ['name', { field: 'slug', cell: platformUi('organization-actions.tsx#OrganizationActions') }, 'createdAt'],
+          columns: ['name', { field: 'slug', cell: backofficeUi('organization-actions.tsx#OrganizationActions') }, 'createdAt'],
           filters: ['name', 'slug', 'createdAt'],
           search: ['name', 'slug'],
           sort: 'name',

package/template/templates/{asas/src/kayan → features}/auth/user/organization.ts

@@ -4,7 +4,7 @@
 // `screens`, beside this file, are imported here on the next run. A kayan
 // built under this one's name elsewhere is refused by every relationship to it.
 import { defaultFields, defaultOperations } from 'mithaq'
-import { defineKayan } from '../../../mithaq.ts'
+import { defineKayan } from '@asas/mithaq'
 import { access } from './organization.access.ts'
 import { screens } from './organization.screens.ts'
 
@@ -20,5 +20,6 @@ export const organization = defineKayan({
     logo: { kind: 'text' },
     createdAt: { kind: 'datetime', rules: { required: true } },
     metadata: { kind: 'text' },
+    names: { kind: 'text' },
   },
 })

package/template/templates/{asas/src/kayan → features}/auth/user/organizationRole.access.ts

@@ -4,5 +4,5 @@
 // Better Auth alone writes and reads this table, through its own adapter,
 // so every managed operation on it is refused to every actor. Written out
 // rather than left to the administrator's default, which a super admin
-// passes in the platform app.
-export { providerOnly as access } from '../../../tenant-access.ts'
+// passes in the backoffice app.
+export { providerOnly as access } from '@asas/mithaq/roles/tenant-access.ts'

package/template/templates/{asas/src/kayan → features}/auth/user/organizationRole.ts

@@ -4,7 +4,7 @@
 // `screens`, beside this file, are imported here on the next run. A kayan
 // built under this one's name elsewhere is refused by every relationship to it.
 import { defaultFields, defaultOperations } from 'mithaq'
-import { defineKayan } from '../../../mithaq.ts'
+import { defineKayan } from '@asas/mithaq'
 import { organization } from './organization.ts'
 import { access } from './organizationRole.access.ts'
 
@@ -16,8 +16,8 @@ export const organizationRole = defineKayan({
   fields: {
     ...defaultFields,
     id: { kind: 'text' },
-    organizationId: { kind: 'relationship', relationTo: () => organization, dbName: 'organization_id', rules: { required: true, onDelete: 'cascade' } },
-    role: { kind: 'text', rules: { required: true } },
+    organizationId: { kind: 'relationship', relationTo: () => organization, dbName: 'organization_id', rules: { required: true, index: true, onDelete: 'cascade' } },
+    role: { kind: 'text', rules: { required: true, index: true } },
     permission: { kind: 'text', rules: { required: true } },
     createdAt: { kind: 'datetime', rules: { required: true } },
     updatedAt: { kind: 'datetime', rules: { nowOnUpdate: true, providedBy: { update: 'application' } } },

package/template/templates/{asas/src/kayan → features}/auth/user/session.access.ts

@@ -4,5 +4,5 @@
 // Better Auth alone writes and reads this table, through its own adapter, so
 // every managed operation on it is refused to every actor. Written out rather
 // than left to the administrator's default, which a super admin passes in the
-// platform app.
-export { providerOnly as access } from '../../../tenant-access.ts'
+// backoffice app.
+export { providerOnly as access } from '@asas/mithaq/roles/tenant-access.ts'

package/template/templates/{asas/src/kayan → features}/auth/user/session.ts

@@ -4,7 +4,7 @@
 // `screens`, beside this file, are imported here on the next run. A kayan
 // built under this one's name elsewhere is refused by every relationship to it.
 import { defaultFields, defaultOperations } from 'mithaq'
-import { defineKayan } from '../../../mithaq.ts'
+import { defineKayan } from '@asas/mithaq'
 import { user } from './user.ts'
 import { access } from './session.access.ts'
 
@@ -21,7 +21,7 @@ export const session = defineKayan({
     updatedAt: { kind: 'datetime', rules: { required: true, nowOnUpdate: true, providedBy: { update: 'application' } } },
     ipAddress: { kind: 'text' },
     userAgent: { kind: 'text' },
-    userId: { kind: 'relationship', relationTo: () => user, dbName: 'user_id', rules: { required: true, onDelete: 'cascade' } },
+    userId: { kind: 'relationship', relationTo: () => user, dbName: 'user_id', rules: { required: true, index: true, onDelete: 'cascade' } },
     impersonatedBy: { kind: 'text' },
     activeOrganizationId: { kind: 'text' },
   },

package/template/templates/{asas/src/kayan → features}/auth/user/user.access.ts

@@ -4,26 +4,27 @@
 // shares.
 //
 // A person is written through no managed operation: Better Auth writes it
-// through its own adapter. The two sides of the platform line read it
+// through its own adapter. The two sides of the backoffice line read it
 // differently, and neither row reaches the other's side. In the tenant app a
 // member reads its active organization's members by their id and their name
 // alone, so a relationship to a person shows a name in the dashboard's cell and
-// picker, and no email, role or ban reaches a tenant. In the platform app a
-// platform role reads every person, each column where it holds that column's key.
+// picker, and no email, role or ban reaches a tenant. Which members: all of them
+// to a holder of `member.find`, otherwise itself and its roles' `peopleAudience`. In the backoffice app a
+// backoffice role reads every person, each column where it holds that column's key.
 //
 // The id and the name are held by `namesInTenant` rather than by a field list
 // on the `'*'` row, because every actor with a role takes the `'*'` row, the
-// platform's included, and a column one row's list leaves out is hidden
+// backoffice's included, and a column one row's list leaves out is hidden
 // whatever the other rows say.
 //
 // The `'*'` row reads every person, and `membersOf` narrows it to the active
 // organization's members: a person carries no tenant column, and a row filter
 // reaches one relationship hop from the kayan's own fields, which `user` has
 // none of toward `member`.
-import { rows, serverTargets } from '../../../mithaq.ts'
-import { membersOf, namesInTenant, platformReads } from '../../../tenant-access.ts'
+import { rows, serverTargets } from '@asas/mithaq'
+import { membersOf, namesInTenant, backofficeReads } from '@asas/mithaq/roles/tenant-access.ts'
 
 export const access = {
-  ...rows({ '*': { read: true }, ...platformReads }, { holds: namesInTenant('user') }),
+  ...rows({ '*': { read: true }, ...backofficeReads }, { holds: namesInTenant('user') }),
   read: membersOf(serverTargets.drizzle),
 }

package/template/templates/{asas/src/kayan → features}/auth/user/user.screens.ts

@@ -1,27 +1,27 @@
 // What each screen draws of the generated `user` kayan, which `mithaq generate
 // auth` imports into `./user.ts` because this file sits beside it, spreading it
 // into the kayan's `targets` after the generated titles of the screens it does
-// not name, so the platform's block here is that screen's whole block, its
+// not name, so the backoffice's block here is that screen's whole block, its
 // title included, and the dashboard keeps the generated one. The dashboard
-// titles a person by name for its cells and pickers, and the platform lists
+// titles a person by name for its cells and pickers, and the backoffice lists
 // every person with the registry's list and acts on each from its row's menu
 // and its own page.
-import { platformUi } from '../../../mithaq.ts'
-import { appPage } from '../../../pages.ts'
+import { backofficeUi } from '@asas/mithaq'
+import { appPage } from '@asas/mithaq/mithaq/pages.ts'
 
 export const screens = {
-  platform: {
+  backoffice: {
     useAsTitle: 'name',
     pages: {
       list: {
         path: '/users',
         page: appPage([{ layout: 'table', main: [{ list: {
-          columns: ['name', 'email', { field: 'role', cell: platformUi('user-actions.tsx#PlatformRole') }, 'banned', 'createdAt'],
+          columns: ['name', 'email', { field: 'role', cell: backofficeUi('user-actions.tsx#BackofficeRole') }, 'banned', 'createdAt'],
           filters: ['name', 'email', 'role', 'banned', 'createdAt'],
           search: ['name', 'email'],
           sort: 'email',
           // Set role, ban and impersonate, after the row menu's View.
-          menu: platformUi('user-actions.tsx#UserMenu'),
+          menu: backofficeUi('user-actions.tsx#UserMenu'),
         } }] }]),
       },
       // A person's record, which a row opens and which only reads: every
@@ -31,10 +31,10 @@ export const screens = {
         page: appPage([{
           layout: 'record',
           main: [
-            { component: platformUi('user-actions.tsx#UserButtons') },
+            { component: backofficeUi('user-actions.tsx#UserButtons') },
             { section: 'person', label: { en: 'Person', ar: 'الشخص' }, fields: ['name', 'email', 'emailVerified', 'image'] },
             // The role by its label, where the column holds the slugs.
-            { section: 'standing', label: { en: 'Standing on the platform', ar: 'الوضع في المنصة' }, fields: [{ field: 'role', cell: platformUi('user-actions.tsx#PlatformRole') }, 'banned', 'banReason', 'banExpires'] },
+            { section: 'standing', label: { en: 'Standing in the backoffice', ar: 'الوضع في لوحة الإدارة الخلفية' }, fields: [{ field: 'role', cell: backofficeUi('user-actions.tsx#BackofficeRole') }, 'banned', 'banReason', 'banExpires'] },
           ],
           // No id: a person reads the record by its name, and the address bar holds the id.
           side: [{ section: 'record', label: { en: 'Record', ar: 'السجل' }, fields: ['createdAt', 'updatedAt'] }],

package/template/templates/{asas/src/kayan → features}/auth/user/user.ts

@@ -4,8 +4,8 @@
 // `screens`, beside this file, are imported here on the next run. A kayan
 // built under this one's name elsewhere is refused by every relationship to it.
 import { betterAuth, defaultFields, defaultOperations } from 'mithaq'
-import { defineKayan } from '../../../mithaq.ts'
-import { providers } from '@asas/auth'
+import { defineKayan } from '@asas/mithaq'
+import { providers } from '@asas/mithaq/auth'
 import { access } from './user.access.ts'
 import { screens } from './user.screens.ts'
 

package/template/templates/{asas/src/kayan → features}/auth/user/verification.access.ts

@@ -4,5 +4,5 @@
 // Better Auth alone writes and reads this table, through its own adapter, so
 // every managed operation on it is refused to every actor. Written out rather
 // than left to the administrator's default, which a super admin passes in the
-// platform app.
-export { providerOnly as access } from '../../../tenant-access.ts'
+// backoffice app.
+export { providerOnly as access } from '@asas/mithaq/roles/tenant-access.ts'

package/template/templates/{asas/src/kayan → features}/auth/user/verification.ts

@@ -4,7 +4,7 @@
 // `screens`, beside this file, are imported here on the next run. A kayan
 // built under this one's name elsewhere is refused by every relationship to it.
 import { defaultFields, defaultOperations } from 'mithaq'
-import { defineKayan } from '../../../mithaq.ts'
+import { defineKayan } from '@asas/mithaq'
 import { access } from './verification.access.ts'
 
 export const verification = defineKayan({
@@ -14,7 +14,7 @@ export const verification = defineKayan({
   fields: {
     ...defaultFields,
     id: { kind: 'text' },
-    identifier: { kind: 'text', rules: { required: true } },
+    identifier: { kind: 'text', rules: { required: true, index: true } },
     value: { kind: 'text', rules: { required: true } },
     expiresAt: { kind: 'datetime', rules: { required: true } },
     createdAt: { kind: 'datetime', rules: { required: true } },